CVE-2026-78551

Name of the Vulnerable Software and Affected Versions RansomLook (affected versions not specified)

Description Weaknesses in the authentication endpoint allow an unauthenticated remote attacker to enumerate valid usernames, perform unrestricted password-guessing attacks, and potentially cause a denial of service. The login process previously verified the existence of a username before performing password hash verification, creating a timing discrepancy that allows attackers to identify valid accounts. Additionally, the '/login' endpoint lacks restrictions on the frequency of failed attempts, enabling brute-force, dictionary, password-spraying, or credential-stuffing attacks. Because the password key-derivation function consumes significant CPU time, a high volume of requests can exhaust synchronous Gunicorn workers, leading to application-wide unavailability.

Recommendations Implement password verification using a dummy password hash when a username does not exist to eliminate timing discrepancies. Apply rate-limiting for failed authentication attempts per client IP address. Configure the reverse-proxy to derive client addresses from a trusted X-Forwarded-For value that cannot be overridden by the client.