{"id":"CVE-2026-62860","kind":"vulnerability","aliases":["CVE-2026-62860"],"related":[],"title":"Picsou: login timing reveals which usernames exist on the server","description":"Picsou is a self-hosted personal finance dashboard. In the affected login implementation, the `/api/auth/login` endpoint reveals whether a username exists through a timing discrepancy. In `backend/src/main/java/com/picsou/controller/AuthController.java`, `AuthController.login()` throws `BadCredentialsException` immediately for an unknown username, before `passwordEncoder.matches(...)`, whereas an existing username with an incorrect password incurs the `bcrypt` comparison cost. Both cases return the same generic `HTTP 401` response, but repeated latency measurements disclose valid usernames without credentials. Login rate limiting, a small user population, and deployments inaccessible from outside the local network limit practical exposure; the weakness does not itself read or modify account data, though enumerated usernames can assist credential stuffing or brute-force attacks. This issue is fixed in repository release 1.0.8.","summary":"Picsou's login endpoint answers faster for unknown usernames than for existing ones, so latency measurements reveal valid accounts. An attacker gets a list of usernames to target with credential guessing, but not the passwords or account data.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["java","package","picsou","self-hosted","spring"],"not_affected_if":["not-network-reachable","version-1.0.8-or-later"],"how_to_check":"- Check the Picsou version in the deployed repository or release tag; versions before `1.0.8` are affected.\n- Look for the timing difference in `backend/src/main/java/com/picsou/controller/AuthController.java`: `login()` throws `BadCredentialsException` before `passwordEncoder.matches(...)` runs for unknown usernames.","fix":"- Picsou: move to `1.0.8`.","status":"open","published_at":"2026-10-30T21:17:14+00:00","first_seen_at":"2026-10-30T21:25:53+00:00","triaged_at":"2026-10-30T21:26:56+00:00","updated_at":"2026-10-30T21:26:56+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-30T21:26:56Z","model":"claude-haiku-5-5","output":{"fix":"- Picsou: move to `1.0.8`.","reach":"network","title":"Picsou: login timing reveals which usernames exist on the server","impact":"low","summary":"Picsou's login endpoint answers faster for unknown usernames than for existing ones, so latency measurements reveal valid accounts. An attacker gets a list of usernames to target with credential guessing, but not the passwords or account data.","audience":"businesses","category":"package","nicknames":[],"who_cares":["picsou","self-hosted","java","spring"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"attacker learns valid usernames for credential guessing","analyst_note":"","how_to_check":"- Check the Picsou version in the deployed repository or release tag; versions before `1.0.8` are affected.\n- Look for the timing difference in `backend/src/main/java/com/picsou/controller/AuthController.java`: `login()` throws `BadCredentialsException` before `passwordEncoder.matches(...)` runs for unknown usernames.","plain_action":"","needs_analyst":false,"not_affected_if":["version-1.0.8-or-later","not-network-reachable"],"who_is_affected":"Teams running a self-hosted Picsou instance with its login endpoint reachable from the network. The timing difference exists in the login code path, so any deployment running a version before 1.0.8 is exposed; the sources say that rate limiting, a small user base, and a network-restricted deployment reduce practical risk. Instances on 1.0.8 or later are not affected.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000716,"input_tokens":4312,"output_tokens":570,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-62860':13A,16A '/api/auth/login':77C '1.0.8':178C '401':120C 'account':42B,60B,157C 'affect':73C 'answer':28B 'assist':163C 'attack':44B,170C 'authcontroller.login':90C 'backend/src/main/java/com/picsou/controller/authcontroller.java':89C 'badcredentialsexcept':92C 'bcrypt':110C 'brute':168C 'brute-forc':167C 'case':114C 'comparison':111C 'cost':112C 'credenti':53B,130C,164C 'cve':11A,14A 'dashboard':70C 'data':61B,158C 'deploy':139C 'disclos':126C 'discrep':87C 'endpoint':27B,78C 'enumer':160C 'exist':7A,35B,83C,102C 'exposur':148C 'faster':29B 'financ':69C 'fix':174C 'forc':169C 'generic':118C 'get':45B 'guess':54B 'host':22B,67C 'http':119C 'immedi':93C 'implement':75C 'inaccess':140C 'incorrect':106C 'incur':108C 'issu':172C 'java':17B 'latenc':38B,124C 'limit':133C,146C 'list':47B 'local':144C 'login':2A,26B,74C,131C 'measur':39B,125C 'modifi':156C 'network':145C 'one':36B 'outsid':142C 'packag':18B 'password':58B,107C 'passwordencoder.matches':99C 'person':68C 'picsou':1A,19B,24B,62C 'popul':137C 'practic':147C 'rate':132C 'read':154C 'releas':177C 'repeat':123C 'repositori':176C 'respons':121C 'return':115C 'reveal':4A,40B,79C 'self':21B,66C 'self-host':20B,65C 'server':10A 'small':135C 'spring':23B 'stuf':165C 'target':51B 'though':159C 'throw':91C 'time':3A,86C 'unknown':31B,96C 'user':136C 'usernam':6A,32B,49B,82C,97C,103C,128C,161C 'valid':41B,127C 'weak':150C 'wherea':100C 'whether':80C 'without':129C","nicknames":[],"mitigations":[],"who_affected":"Teams running a self-hosted Picsou instance with its login endpoint reachable from the network. The timing difference exists in the login code path, so any deployment running a version before 1.0.8 is exposed; the sources say that rate limiting, a small user base, and a network-restricted deployment reduce practical risk. Instances on 1.0.8 or later are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T21:17:14+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-62860","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62860","severity":null,"published_at":"2026-10-30T21:17:14+00:00","modified_at":"2026-10-30T21:17:14+00:00","first_seen_at":"2026-10-30T21:25:53+00:00","fetched_at":"2026-10-30T21:25:53+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}