CVE-2026-62860

Picsou is a self-hosted personal finance dashboard. In the affected login implementation, the `/api/auth/login` endpoint reveals whether a username exists through a timing discrepancy. In `backend/src/main/java/com/picsou/controller/AuthController.java`, `AuthController.login()` throws `BadCredentialsException` immediately for an unknown username, before `passwordEncoder.matches(...)`, whereas an existing username with an incorrect password incurs the `bcrypt` comparison cost. Both cases return the same generic `HTTP 401` response, but repeated latency measurements disclose valid usernames without credentials. Login rate limiting, a small user population, and deployments inaccessible from outside the local network limit practical exposure; the weakness does not itself read or modify account data, though enumerated usernames can assist credential stuffing or brute-force attacks. This issue is fixed in repository release 1.0.8.

• CWE-208

• https://github.com/Cloeille/picsou-finance/commit/877ac0f7c651612e15f0dbac5de8e96d66bbcf59
• https://github.com/Cloeille/picsou-finance/releases/tag/1.0.8
• https://github.com/Cloeille/picsou-finance/security/advisories/GHSA-ww5m-pxgq-8qq6

Published

Oct 30, 2026

Last Modified

Oct 30, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-62849ThingLinks is an enterprise IoT platform. Prior to 1.4.0, an…9.1
• CVE-2026-6285Weak Password Recovery Mechanism for Forgotten Password vuln…7.5
• CVE-2026-62853ThingLinks is an enterprise IoT platform. Prior to 1.4.0, th…9.9
• CVE-2026-62857Fedify is a TypeScript library for building federated server…8.8
• CVE-2026-62858YOURLS is a self-hosted, customizable URL shortener written …5.3
• CVE-2026-6286The Booking for Appointments and Events Calendar – Amelia pl…7.2
• CVE-2026-62861TypeBot is a chatbot builder tool. Prior to 3.18.0, any auth…6.4
• CVE-2026-62862Typebot is an open-source chatbot builder. In self-hosted ve…9.1
• CVE-2026-62863MoLing is a computer-use and browser-use based MCP server. P…9.6
• CVE-2026-62864Ring is a Clojure web applications library inspired by Pytho…7.5
• CVE-2026-62865Typebot is an open-source chatbot builder. In self-hosted ve…8.7
• CVE-2026-62866Dasel is a command-line tool and library for querying, modif…6.2