The /api/auth/login endpoint in FileBrowser Quantum before version 1.3.2‑beta performs a non‑constant time authentication routine. Requests with an unknown username return a 401 or 403 almost instantly, while requests with a valid username invoke a bcrypt password comparison, introducing a measurable delay. This timing difference allows an attacker to determine which usernames exist, enablingchannel vulnerability (CWE‑208) and can be used as a preliminary step toward credential guessing or privilege escalation.

The affected product is FileBrowser Quantum, a free, self‑hosted, web‑based file manager developed by gtsteffaniak. Versions older than 1.3.2‑beta expose the flaw, as older releases of the `/api/auth/login` endpoint perform an early reject for unknown users and invoke bcrypt for known of these versions, whether accessed directly or from the internet, are susceptible.

The CVSS score of 5.3 indicates moderate severity. The EPSS score is < 1%, suggesting a low probability of widespread exploitation at present. The vulnerability is discovered over the network via the public authentication API, meaning remote attackers who can reach the service can perform enumeration. Though the bug does not grant direct code execution, it provides valuable information that can accelerate subsequent attacks, so timely patching is advised. The issue is not listed in CISA’s KEV catalog.