CVE-2026-78551 – Authentication Bypass via Timing Attack & Missing Rate Limiting (DoS) – RansomLook

Summary

CVE-2026-78551 affects RansomLook, an open ransomware intelligence platform, versions 0 through 2.0.0. The application’s /login endpoint suffered from an observable timing discrepancy that allowed remote attackers to enumerate valid usernames, combined with a complete lack of rate-limiting that permitted unrestricted brute-force, dictionary, and credential-stuffing attacks. Because each login attempt consumed a Gunicorn worker for a measurable amount of time, high-frequency automated login attempts could also exhaust available workers and cause a denial-of-service condition. The vulnerability has a CVSS score of 8.8 (HIGH).

Technical details

• Root cause: The login handler checked whether a submitted username existed in the database before performing password hash verification. For nonexistent accounts, the hashing step was skipped entirely, producing a measurably faster response than for valid accounts where password hashing was executed.
• Trigger conditions: An unauthenticated remote attacker sends repeated login requests to /login with different usernames and measures response times to distinguish valid from invalid accounts, then mounts credential-stuffing or brute-force attacks against confirmed valid accounts.
• Attack vector: Network-based, no authentication or user interaction required (CVSS AV:N/AC:L/AT:N/PR:N/UI:N).
• Impact: Username enumeration via timing side-channel; unrestricted password-guessing attacks against confirmed accounts; and denial of service, since each authentication attempt costs Gunicorn worker time (~60ms), and an unthrottled /login endpoint can saturate available workers under high request volume, causing high availability impact (CVSS VA:H).
• Additional weakness: The application did not properly validate/trust X-Forwarded-For headers for client IP identification, undermining any IP-based mitigation attempts.

Affected software

• RansomLook (RansomLook/RansomLook on GitHub), versions 0 through 2.0.0

Severity

• CVSS v4.0 Base Score: 8.8 (HIGH)
• Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
• Relevant weaknesses: CWE-307 (Improper Restriction of Excessive Authentication Attempts), CWE-400 (Uncontrolled Resource Consumption)

Mitigation and recommended actions

• Immediate: Upgrade to the patched RansomLook release that includes commit 8602740347b0e928ad9fbaf5bc6ff242337dec6b, which:
  • Always performs password verification against a dummy hash for nonexistent accounts, equalizing response times and eliminating the timing side-channel.
  • Implements per-client-IP rate limiting on /login (5 failed attempts within 5 minutes triggers a 1-hour block).
  • Corrects reverse-proxy/Nginx configuration so client IP addresses are properly and reliably identified (avoiding spoofable or dropped X-Forwarded-For handling) for accurate rate-limit enforcement.
• If immediate patching is not possible:
  • Place a reverse proxy or WAF in front of the RansomLook instance to enforce request-rate limiting on the /login endpoint independently of the application.
  • Monitor authentication logs for high-frequency login attempts from single or distributed sources and block offending IPs at the network layer.
  • Ensure any X-Forwarded-For trust configuration in front-end proxies (e.g., Nginx) is correctly scoped to only trusted proxy hops to prevent IP spoofing that could bypass IP-based mitigations.
  • Enforce strong, unique passwords and consider multi-factor authentication for administrative accounts to reduce the impact of credential-stuffing attempts.

References

• CVE-2026-78551 CVE Record (CVEProject/cvelistV5)
• RansomLook Patch Commit
• CVE-2026-78551 at NVD