PaperCut NG/MF authentication contains a measurable timing discrepancy that allows an unauthenticated remote attacker to determine if a username exists. By measuring response times to login attempts, the system reveals whether a password hash comparison was executed. The vulnerability enables identity discovery but does not provide direct code execution or privilege escalation. It is classified as CWE‑208, an information‑leakage weakness.

All installations of PaperCut NG/MF are potentially impacted, regardless of version, as the timing issue is present in the core authentication component described in the vendor bulletin. No version range is specified in the CNA data, so all deployments should be reviewed.

The CVSS score of 6.9 indicates moderate severity. The EPSS score is < 1%, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is remote over a network connection, and the problem can be exploited by anyone who can reach the login interface. Because the vulnerability is present on the public endpoint, the risk is that an attacker can enumerate valid accounts and then target them with more focused credential‑guessing or social‑engineering attacks.