CVE-2026-32702

Cleanuparr is a tool for automating the cleanup of unwanted or blocked files in Sonarr, Radarr, and supported download clients like qBittorrent. From 2.7.0 to 2.8.0, the /api/auth/login endpoint contains a logic flaw that allows unauthenticated remote attackers to enumerate valid usernames by measuring the application's response time. It appears that the hashing function, which is the most time-consuming part of the process by design, occurs as part of the VerifyPassword function. With the short circuits occurring before the hashing function, a timing differential is introduced that exposes validity to the actor. This vulnerability is fixed in 2.8.1.

• CWE-208

• https://github.com/Cleanuparr/Cleanuparr/security/advisories/GHSA-gjmf-m27r-2c9vExploit, Mitigation, Vendor Advisory
• https://github.com/Cleanuparr/Cleanuparr/security/advisories/GHSA-gjmf-m27r-2c9vExploit, Mitigation, Vendor Advisory

Published

Mar 16, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-32697SuiteCRM is an open-source, enterprise-ready Customer Relati…6.5
• CVE-2026-32698OpenProject is an open-source, web-based project management …7.2
• CVE-2026-32699FacturaScripts is an open source accounting and invoicing so…5.3
• CVE-2026-3270A vulnerability has been found in psi-probe PSI Probe up to …8.8
• CVE-2026-32700Devise is an authentication solution for Rails based on Ward…5.3
• CVE-2026-32701Qwik is a performance-focused JavaScript framework. Versions…7.5
• CVE-2026-32703OpenProject is an open-source, web-based project management …5.4
• CVE-2026-32704SiYuan is a personal knowledge management system. Prior to 3…6.5
• CVE-2026-32705PX4 autopilot is a flight control solution for drones. Prior…6.8
• CVE-2026-32706PX4 autopilot is a flight control solution for drones. Prior…8.1
• CVE-2026-32707PX4 autopilot is a flight control solution for drones. Prior…6.1
• CVE-2026-32708PX4 autopilot is a flight control solution for drones. Prior…8