medium5.3
CVE-2026-61503
Rejetto HFS 3.0.0 through 3.2.0 returns observably different responses from its login endpoint depending on whether the submitted username exists.
Impact
Rejetto HFS 3.0.0 through 3.2.0 returns observably different responses from its login endpoint depending on whether the submitted username exists. A remote unauthenticated attacker can use this to confirm valid account names, including the default admin account, facilitating password-guessing and session-forgery attacks.
Affected products
| Product | Affected versions |
|---|---|
| Rejetto HFS 3.0.0 | through 3.2.0 |
Versions were read from the advisory text. No structured product data has been published for this record yet.