File Browser’s authentication routine prematurely exits when a supplied username does not exist, whereas it performs a costly bcrypt comparison for existing usernames. This timing difference allows an unauthenticated attacker to deduce valid usernames by consistently measuring response latency, thereby revealing account names that could be leveraged for subsequent credential abuse or social engineering. The weakness is classified as CWE-203 and CWE-208, representing information leakage through timing and race conditions.

The flaw affects all instances of File Browser prior to version 2.55.0. Users deploying any version before that threshold, regardless of operating system or environment, are susceptible if the /api/login interface is exposed to the network.

The CVSS score of 5.3 indicates moderate impact, and the EPSS score of less than 1% suggests a low probability of exploitation under current threat intelligence. However, the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to measure timing accurately, which may be easier on low‑latency, high‑packet‑rate networks. The attack vector is primarily remote, accessed through the web API endpoint exposed over the network. Once enumeration is achieved, attackers can attempt to guess or brute‑force passwords for the revealed accounts, potentially escalating to full compromise of the file management system.