Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-62860— Picsou vulnerable to login timing attack

Quick assessment

Affected
Zoeille picsou-finance
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Picsou 是一个自托管的个人财务仪表板。在受影响的登录实现中， 端点通过时间差异泄露了用户名是否存在。在 的 方法中，对于未知的用户名会立即抛出 ，而不会执行 ；而对于已存在但密码错误的用户名，则会产生 比较带来的计算开销。尽管两种情况均返回相同的通用 响应，但通过重复测量延迟，攻击者无需凭证即可枚举出有效的用户名。登录速率限制、用户群体规模较小以及部署环境通常无法从外部网络访问，这些因素限制了该漏洞的实际暴露风险；该弱点本身不会读取或修改账户数据，但被枚举出的用户名可被用于凭证填充（credential st

CVSS 5.3 · Medium
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-62860

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Picsou vulnerable to login timing attack
Source: CVE Program / CVE List V5
Vulnerability Description
Picsou is a self-hosted personal finance dashboard. In the affected login implementation, the `/api/auth/login` endpoint reveals whether a username exists through a timing discrepancy. In `backend/src/main/java/com/picsou/controller/AuthController.java`, `AuthController.login()` throws `BadCredentialsException` immediately for an unknown username, before `passwordEncoder.matches(...)`, whereas an existing username with an incorrect password incurs the `bcrypt` comparison cost. Both cases return the same generic `HTTP 401` response, but repeated latency measurements disclose valid usernames without credentials. Login rate limiting, a small user population, and deployments inaccessible from outside the local network limit practical exposure; the weakness does not itself read or modify account data, though enumerated usernames can assist credential stuffing or brute-force attacks. This issue is fixed in repository release 1.0.8.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过时间差异性导致的信息暴露
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Zoeille picsou-finance < 1.0.8 -

II. Public POCs for CVE-2026-62860

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-62860

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-62860 (1)

Vendor Advisories for CVE-2026-62860 (1)

Vendor Pages for CVE-2026-62860 (1)

IV. Related Vulnerabilities

Same weakness: CWE-208