CVE-2026-54685: FileBrowser Quantum Auth Bypass Flaw

CVE-2026-54685 Overview

CVE-2026-54685 is a username enumeration vulnerability in FileBrowser Quantum, a self-hosted web-based file manager. The flaw resides in the /api/auth/login authentication endpoint, which does not execute in constant time. When an attacker submits a non-existent username, the server returns a 401 or 403 response almost immediately. When a valid username is supplied, the server performs a bcrypt password comparison, introducing a measurable response delay. Attackers can measure this timing difference to enumerate valid usernames on the target instance. Version 1.3.2-beta patches the issue. The vulnerability is classified under CWE-208: Observable Timing Discrepancy.

Critical Impact
Unauthenticated remote attackers can enumerate valid usernames by measuring authentication response times, enabling targeted brute-force and credential-stuffing campaigns.

Affected Products

FileBrowser Quantum versions prior to 1.3.2-beta
The /api/auth/login authentication endpoint
Self-hosted FileBrowser Quantum deployments exposed to untrusted networks

Discovery Timeline

2026-07-20 - CVE-2026-54685 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-54685

Vulnerability Analysis

The vulnerability is a classic side-channel timing attack in the authentication flow. FileBrowser Quantum's login handler short-circuits when the submitted username does not exist in the user store, returning an unauthorized response without performing any password hashing work. When the username exists, the handler proceeds to compute a bcrypt hash comparison against the stored password. Bcrypt is intentionally expensive, so this additional work produces a consistent, observable latency delta between valid and invalid usernames.

An attacker scripting login requests can differentiate the two response classes by measuring round-trip time. This transforms an anonymous endpoint into a username oracle, undermining defense-in-depth assumptions that usernames remain confidential.

Root Cause

The root cause is the absence of a constant-time authentication path. The upstream fix introduces a SetInvalidPasswordHash() utility that ensures a bcrypt comparison is performed even when the username is not found, equalizing the computational cost of both code paths.

Attack Vector

Exploitation requires only network access to the /api/auth/login endpoint. No authentication, user interaction, or elevated privileges are needed. An attacker sends a series of login requests with candidate usernames and a dummy password, then statistically analyzes response times to identify accounts that trigger the slower bcrypt path.

// Security patch in backend/cmd/root.go - Username enumeration fix (#2144)
// Ensures an invalid password hash is initialized at startup so that
// bcrypt comparison runs even for non-existent usernames.

	settings.Env.EmbeddedFs = os.IsNotExist(err)
}

+	err = utils.SetInvalidPasswordHash()
+	if err != nil {
+		logger.Fatalf("Failed to set security hash: %v", err)
+	}
+
	sourceList := []string{}
	for path, source := range settings.Config.Server.SourceMap {
		sourceList = append(sourceList, fmt.Sprintf("%v: %v", source.Name, path))

Source: GitHub commit af08800

Detection Methods for CVE-2026-54685

Indicators of Compromise

High-volume POST requests to /api/auth/login originating from a single IP or narrow IP range within a short window.
Login attempts iterating through common usernames (admin, root, test, user) with identical or randomized password values.
Sequential requests with response-time measurement patterns visible in reverse-proxy or WAF telemetry.

Detection Strategies

Instrument the authentication endpoint to log response latency and correlate slow responses with source IPs and submitted usernames.
Alert on repeated 401/403 responses from /api/auth/login exceeding a defined threshold per source IP.
Deploy WAF rules that flag rapid enumeration patterns against authentication endpoints regardless of response code.

Monitoring Recommendations

Forward FileBrowser Quantum access logs to a centralized log platform and build dashboards for authentication failure rates.
Track distinct usernames attempted per source IP to surface enumeration behavior early.
Enable geolocation and reputation enrichment on authentication traffic to detect requests from unexpected regions or known malicious infrastructure.

How to Mitigate CVE-2026-54685

Immediate Actions Required

Upgrade FileBrowser Quantum to version 1.3.2-beta or later, which introduces the SetInvalidPasswordHash() equalization fix.
Restrict network access to the FileBrowser Quantum instance using firewall rules, VPN, or reverse-proxy allowlists until patching is complete.
Enforce rate limiting on /api/auth/login at the reverse proxy or WAF layer to slow enumeration attempts.

Patch Information

The fix is available in the FileBrowser Quantum v1.3.2-beta release. The upstream code change is documented in GitHub commit af08800 and the GHSA-7789-65hx-f26w security advisory. The patch ensures a bcrypt comparison against a dummy hash runs when the username is not found, equalizing response time between valid and invalid accounts.

Workarounds

Place FileBrowser Quantum behind an authenticating reverse proxy so the vulnerable endpoint is not directly reachable.
Apply strict rate limiting and account lockout policies at the proxy layer to blunt enumeration attempts.
Rename default administrative usernames to reduce the value of successful enumeration.

bash

# Example nginx rate limit for the login endpoint
http {
    limit_req_zone $binary_remote_addr zone=fb_login:10m rate=5r/m;

    server {
        location = /api/auth/login {
            limit_req zone=fb_login burst=3 nodelay;
            proxy_pass http://filebrowser_backend;
        }
    }
}