CWE-307: The login endpoint in the RansomLook application has a flaw that allows an attacker to discover existing usernames by measuring response times. The system performs password verification only after confirming that a username exists, so requests for unknown usernames return quickly, while valid usernames trigger a computationally expensive password hash check. By comparing the timings, an attacker can enumerate accounts. In addition, there is no throttling on failed login attempts, so an attacker can execute brute-force, dictionary, or credential-stuffing attacks against known usernames, consuming CPU resources through repeated hashing. If performed at a high rate, this can exhaust Gunicorn workers and cause a denial of service for legitimate traffic.

The vulnerability affects the RansomLook web application developed by ransomlook. No specific version numbers are listed in the advisory, so any deployment running the affected application may be at risk.

The CVSS base score of 8.8 classifies this as high severity, reflecting the ability for an unauthenticated attacker to enumerate accounts and carry out unrestricted brute-force attempts. The lack of an EPSS score means we currently have no estimate of exploit probability, but the vulnerability is publicly documented and not listed in the CISA KEV. Attackers can exploit it remotely over HTTP or HTTPS by sending crafted login requests, measuring timing differences, and performing rapid authentication attempts without encountering server-side throttling. If exploited, the attacker could compromise user credentials and disrupt service availability.