CVE-2026-41418

The record

4ga Boards is a boards system for realtime project management. Prior to 3.3.5, 4ga Boards is vulnerable to user enumeration via a timing side-channel in the login endpoint (POST /api/access-tokens). When an invalid username/email is provided, the server responds immediately (~17ms average). When a valid username/email is provided with an incorrect password, the server first performs a bcrypt.compareSync() operation (~74ms average) before responding. This ~4.4× timing difference is trivially detectable even over a network — a single request suffices. This vulnerability is fixed in 3.3.5.

Affected packages

Related vulnerabilities

• CVE-2026-87946 Observable Timing Discrepancy vulnerability in Drupal SAML SSO - Service Provider allows… CWE-208
• CVE-2026-49265 OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. CWE-208
• CVE-2026-77696 Issue summary: SM2 signature generation uses non-constant-time arithmetic on secret… CWE-208
• CVE-2026-54875 Issue summary: A non-constant-time optimized implementation of scalar point… CWE-208
• CVE-2026-54872 Issue summary: The generic elliptic-curve scalar multiplication used for ECDSA and SM2… CWE-208
• CVE-2026-87737 An issue was discovered in the mirage-crypto-ec package before 2.4.0 for OCaml. CWE-208
• CVE-2026-84308 phpseclib is a PHP secure communications library. CWE-208
• CVE-2026-82449 Cockpit CMS before 2.14.1 contains an account enumeration vulnerability in the auth check… CWE-208