CVE-2025-30344

Name of the Vulnerable Software and Affected Versions OpenSlides versions prior to 4.2.5

Description An issue was discovered where the system's response times differ depending on whether a user exists in the system during login at the "/system/auth/login/" endpoint. This timing discrepancy is due to the omitted hashing of the password, resulting in a noticeable delay of more than 100 milliseconds.

Recommendations For versions prior to 4.2.5, update to version 4.2.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the "/system/auth/login/" endpoint to minimize the risk of exploitation.