The flaw in the POST /api/access-tokens endpoint allows an attacker to determine whether a username or e‑mail address exists by measuring the response time. An invalid credential triggers an almost instantaneous reply (≈17 ms), whereas a valid username with a wrong password forces a bcrypt.compareSync() operation that takes roughly 74 ms, creating a 4.4‑fold timing gap that is easily detectable over a network. This timing side‑channel falls under CWE‑208 and can be exploited with a single request to enumerate valid accounts.

Administrators of RARgames 4ga Boards should verify that their installations are running version 3.3.5 or later; prior releases lack the mitigation that removes the timing difference in the authentication endpoint.

The CVSS score of 5.3 places the vulnerability in the medium severity range. An EPSS score of less than 1 % suggests a low probability of exploitation, and the flaw is not listed in CISA’s KEV catalog. The attack vector is remote over the network: an external actor can simply send a single login request to discover valid accounts, potentially aiding subsequent credential‑based attacks.