CVE-2026-8794: PaperCut NG/MF Auth Bypass Vulnerability

CVE-2026-8794 Overview

CVE-2026-8794 is an observable timing discrepancy vulnerability in the authentication component of PaperCut NG/MF print management software. The application performs a password hash comparison only when a submitted username matches an existing account. This behavior creates a measurable timing oracle. An unauthenticated remote attacker can compare server response times across login attempts to determine which usernames are valid.

The issue is classified under CWE-208: Observable Timing Discrepancy. Successful exploitation reveals valid account names, which attackers can then feed into password spraying, credential stuffing, or targeted phishing campaigns against the print management infrastructure.

Critical Impact
An unauthenticated network attacker can enumerate valid PaperCut NG/MF user accounts by measuring authentication response times, enabling downstream credential attacks against confirmed accounts.

Affected Products

PaperCut NG (versions prior to the fix noted in the August 2026 security bulletin)
PaperCut MF (versions prior to the fix noted in the August 2026 security bulletin)
Deployments exposing the PaperCut authentication endpoint to untrusted networks

Discovery Timeline

2026-08-03 - CVE-2026-8794 published to NVD alongside the PaperCut Security Bulletin
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-8794

Vulnerability Analysis

The vulnerability resides in the login path of PaperCut NG/MF. When a login request arrives, the server first checks whether the supplied username corresponds to a real account. If no account exists, the server returns a failure without executing the password hash comparison routine. If the account exists, the server proceeds to hash and compare the submitted password against the stored value.

Hash comparison is computationally expensive relative to a simple account lookup. This asymmetry produces a measurable delta between responses for valid and invalid usernames. An attacker scripting sequential login attempts can statistically distinguish the two response classes, even under network jitter, by averaging multiple samples per candidate username.

The flaw does not directly leak passwords or session tokens. However, confirmed usernames materially reduce the search space for follow-on attacks such as password spraying against Active Directory synced accounts or targeted phishing of print administrators.

Root Cause

The root cause is a control-flow branch in the authentication handler that gates the expensive cryptographic comparison behind the account-existence check. The code path lacks a constant-time equivalent operation, such as executing a dummy hash comparison against a fixed value when the account is absent. This branch difference is directly observable through response latency.

Attack Vector

Exploitation requires only network access to the PaperCut web authentication endpoint. No credentials, user interaction, or prior foothold are needed. An attacker submits candidate usernames from a wordlist against the login endpoint, records server response times, and applies statistical analysis to separate valid usernames from invalid ones based on the timing signal produced by the conditional hash comparison.

No verified proof-of-concept code has been published. See the PaperCut Security Bulletin for vendor-supplied technical details.

Detection Methods for CVE-2026-8794

Indicators of Compromise

High-volume authentication requests from a single source IP against the PaperCut login endpoint within short time windows
Sequential login attempts iterating through predictable username patterns such as firstname.lastname or common administrative accounts
Login attempts using non-browser User-Agent strings or scripting library signatures such as python-requests or curl
Repeated failed authentications with no successful follow-up from the same source, indicating reconnaissance rather than credential stuffing

Detection Strategies

Alert on authentication request rates exceeding a baseline threshold per source IP against the PaperCut login URL
Correlate failed login events against the count of distinct usernames attempted per source within a rolling window
Flag login traffic from IP addresses that have never previously interacted with the print management service

Monitoring Recommendations

Enable verbose authentication logging in the PaperCut admin console and forward events to a centralized SIEM
Monitor web application firewall telemetry for repeated POST requests to the PaperCut login path
Track downstream authentication activity for accounts that were probed, as enumeration typically precedes password spraying

How to Mitigate CVE-2026-8794

Immediate Actions Required

Apply the fixed version identified in the PaperCut Security Bulletin dated 3 August 2026
Restrict network access to the PaperCut administrative and user login interfaces using firewall rules or a reverse proxy
Enforce multi-factor authentication on all PaperCut administrator accounts to blunt downstream credential attacks
Audit existing PaperCut accounts and disable dormant or default accounts that attackers commonly target during enumeration

Patch Information

PaperCut published a security bulletin on 3 August 2026 addressing this issue. Administrators should consult the PaperCut Security Bulletin for the exact fixed release versions applicable to their deployment and follow the vendor upgrade procedure for both Application Server and Site Server components.

Workarounds

Place the PaperCut login endpoint behind a VPN or zero-trust network access gateway to eliminate unauthenticated exposure
Deploy a web application firewall rule that rate-limits authentication attempts per source IP against the login path
Configure account lockout thresholds within PaperCut to slow automated enumeration and increase attacker cost
Segment the PaperCut server on a management VLAN with strict ingress controls from user subnets

bash

# Example nginx reverse proxy rate limit for the PaperCut login endpoint
http {
    limit_req_zone $binary_remote_addr zone=papercut_login:10m rate=5r/m;

    server {
        location /app {
            limit_req zone=papercut_login burst=10 nodelay;
            proxy_pass http://papercut-backend:9191;
        }
    }
}