A flaw in BusyBox's httpd web server can allow an attacker to determine whether a given local username exists on the system by observing how the server responds to authentication attempts. The vulnerability manifests when the server is configured with system password authentication and built without the FEATURE_SHADOWPASSWDS flag. It provides no direct code execution or privilege escalation; the only disclosed information is a list of usernames.

The issue affects BusyBox web servers that are part of Red Hat Hardened Images (Hummingbird 1) when compiled with non‑default shadow‑disabled options. The build must enable system password authentication while omitting the FEATURE_SHADOWPASSWDS setting. Default BusyBox images that include shadow password support are not impacted.

The CVSS score of 3.7 indicates low severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker would need the ability to send authentication requests to the affected httpd instance, but the documentation does not specify whether local or remote access is required. The weakness is an information disclosure that allows username enumeration only, with no direct path to higher privileges. Risk remains limited to reconnaissance.