This vulnerability is a timing discrepancy in the AdminServer.Login handler that allows an attacker to measure response times from the POST /login endpoint. By submitting a series of candidate usernames, an unauthenticated user can detect the additional bcrypt comparison delay that occurs for existing accounts, thereby discovering valid usernames. The impact is a loss of confidentiality: the attacker gains the ability to enumerate active accounts, which can be followed up with credential‑guessing or credential‑stuffing attacks. The weakness is identified as CWE‑208.

The affected product is Gophish, version 0.12.1 and any earlier release. The issue is present in the ./controllers/route.go file at lines 375‑390. Users running v0.12.1 or older should review their installations for this bug.

The CVSS score of 6.3 reflects a medium severity risk due to lack of authentication requirements and the ease of detecting timing differences. Although no EPSS value is reported, the attack is straightforward and does not require special setup beyond access to the web interface. The vulnerability is not listed in CISA's KEV catalog, suggesting no confirmed large‑scale exploitation yet, but the basic method is publicly documented and could be automated. Attackers can exploit it from any network location that can reach the /login endpoint, without administrative privileges.