This vulnerability allows an attacker to discover which usernames exist in the system by measuring the time it takes for the server to respond to Basic Authentication attempts. The server performs a username check before verifying the password, causing a delay for valid usernames (e.g., due to bcrypt hashing) while invalid usernames are rejected immediately. This timing difference reveals valid accounts, enabling attackers to conduct focused brute‑force or credential‑stuffing attacks. The impact is primarily the exposure of legitimate usernames, which facilitates subsequent credential‑guessing or social‑engineering attacks, but does not directly disclose passwords or grant elevated privileges.

Static Web Server version 2.1.0 through 2.40.1 is affected. The issue has been fixed in version 2.41.0. All installations of the affected range should be reviewed and upgraded accordingly.

The CVSS base score is 5.3, indicating moderate severity. The EPSS score is less than 1%, suggesting low current exploitation likelihood, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be network‑based, requiring an attacker to initiate Basic Authentication over HTTP/HTTPS to observe response times. While the technique is relatively simple, it typically requires automated scripts and precise timing measurements and can be mitigated by ensuring uniform response times for all authentication attempts.