Executive Summary

CVE-2026-32702 is a timing attack vulnerability in the Cleanuparr application versions 2.7.0 to 2.8.0. It exists in the /api/auth/login endpoint due to a logic flaw in the authentication process that causes inconsistent response times depending on whether a username is valid or not.

Specifically, the password verification step uses the computationally expensive BCrypt hashing function and is only executed if the username exists and is not locked out. This creates a timing difference because invalid usernames return responses quickly, while valid usernames take longer due to the hashing step.

Attackers can measure these timing differences remotely to enumerate valid usernames without authentication, exploiting the timing side channel. The vulnerability is fixed in version 2.8.1.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows unauthenticated remote attackers to discover valid usernames by measuring response times during login attempts.

• Attackers can use the enumerated usernames to launch targeted brute-force or credential stuffing attacks.
• It facilitates social engineering attacks by confirming valid user identities.
• Overall, it weakens the security posture of the application by exposing sensitive authentication information.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by measuring the response times of the /api/auth/login endpoint to distinguish valid usernames from invalid ones based on timing differences.

Specifically, valid usernames cause the application to perform a BCrypt password hash verification, resulting in longer response times (~350-500ms), while invalid usernames return responses much faster (~30-60ms).

Attackers can exploit these timing differences using tools such as the TickTock Enum Burp Suite extension to remotely enumerate valid usernames without authentication.

To detect this on your network or system, you can use timing analysis tools or scripts that repeatedly send login requests with different usernames and measure the response times to identify discrepancies.

Example commands or approaches include using curl in a loop with timestamps or specialized Burp Suite extensions like TickTock Enum to automate timing measurements.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade the Cleanuparr application to version 2.8.1 or later, where this timing attack vulnerability has been fixed.

The fix involves ensuring consistent response times for authentication requests regardless of username validity, preventing attackers from distinguishing valid usernames via timing differences.

Until the upgrade can be applied, consider implementing network-level protections such as rate limiting, IP blocking, or web application firewalls to reduce the risk of automated timing attacks.

Useful 0 Not Useful 0