CVE-2026-61503: Rejetto HFS Information Disclosure Flaw

CVE-2026-61503 Overview

CVE-2026-61503 is a username enumeration vulnerability affecting Rejetto HTTP File Server (HFS) versions 3.0.0 through 3.2.0. The login endpoint returns observably different responses depending on whether a submitted username exists in the system. A remote unauthenticated attacker can exploit this response differential to confirm valid account names, including the default admin account. This weakness is classified under [CWE-204: Observable Response Discrepancy]. Confirmed usernames enable follow-on password-guessing and session-forgery attacks against exposed HFS instances.

Critical Impact
Remote unauthenticated attackers can enumerate valid usernames on HFS servers, providing reconnaissance data for credential-based attacks against exposed file-sharing infrastructure.

Affected Products

Rejetto HFS 3.0.0
Rejetto HFS 3.1.x
Rejetto HFS 3.2.0

Discovery Timeline

2026-07-13 - CVE-2026-61503 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-61503

Vulnerability Analysis

Rejetto HFS 3 exposes a login endpoint that processes username and password submissions from remote clients. The endpoint's response behavior differs measurably when the submitted username exists versus when it does not exist. Differences may manifest as distinct HTTP response bodies, status codes, error messages, or measurable timing variations. An attacker submits candidate usernames and observes the responses to build a list of valid accounts. Because HFS ships with a default admin account, this account is trivially confirmable in unmodified deployments.

The vulnerability requires no authentication and no user interaction. It targets the confidentiality of account metadata rather than data stored on the server. Once valid usernames are identified, attackers can focus brute-force, credential-stuffing, or session-forgery attempts on real accounts, materially increasing the success rate of subsequent intrusion attempts.

Root Cause

The root cause is inconsistent handling of authentication failure paths within the HFS login logic. Rather than returning a uniform response for all failed logins, the server differentiates between "user does not exist" and "user exists but password is wrong." This violates the principle that authentication failures should be indistinguishable from an external observer's perspective.

Attack Vector

Exploitation occurs over the network against the HFS HTTP interface. An attacker sends crafted login requests using candidate usernames drawn from wordlists, common defaults, or organizational context. The attacker compares response attributes across requests to classify each username as valid or invalid. The technique requires only a standard HTTP client and can be automated at scale. See the VulnCheck Advisory on Username Enumeration for additional technical context.

Detection Methods for CVE-2026-61503

Indicators of Compromise

High volumes of failed login POST requests to the HFS login endpoint originating from a single source IP or small IP set.
Sequential or dictionary-style username submissions in HFS access logs within short time windows.
Requests targeting the default admin account followed by requests for other candidate usernames.

Detection Strategies

Baseline normal login request rates for HFS instances and alert on statistical deviations indicative of enumeration.
Inspect web server or reverse proxy logs for repeated login attempts with distinct usernames and identical or similar client fingerprints.
Correlate HFS login traffic with threat intelligence feeds to identify enumeration attempts from known scanner infrastructure.

Monitoring Recommendations

Forward HFS access logs to a centralized logging platform and enable rate-based alerting on the login endpoint.
Track unique username counts per source IP over rolling time windows to surface enumeration behavior.
Monitor response-time distributions and response-size variance on the login endpoint to detect automated probing.

How to Mitigate CVE-2026-61503

Immediate Actions Required

Upgrade Rejetto HFS to version 3.2.1 or later, which addresses the response differential in the login endpoint.
Rename or disable the default admin account and enforce strong, unique passwords for all HFS user accounts.
Restrict HFS exposure to trusted networks using firewall rules or a reverse proxy with IP allowlisting.

Patch Information

The vendor released a fix in version 3.2.1. Refer to the GitHub Release v3.2.1 for release notes and download artifacts. Administrators should validate the patched build in a staging environment before rolling out to production HFS instances.

Workarounds

Place HFS behind a reverse proxy or web application firewall that normalizes authentication responses and rate-limits login attempts.
Implement account lockout or exponential backoff on repeated failed login attempts to reduce enumeration efficiency.
Require VPN or client certificate authentication before HFS becomes reachable, eliminating unauthenticated internet exposure.

bash

# Example nginx reverse proxy rate limit for HFS login endpoint
limit_req_zone $binary_remote_addr zone=hfs_login:10m rate=5r/m;

server {
    listen 443 ssl;
    server_name hfs.example.com;

    location /~/login {
        limit_req zone=hfs_login burst=5 nodelay;
        proxy_pass http://127.0.0.1:8080;
    }

    location / {
        proxy_pass http://127.0.0.1:8080;
    }
}