CVE-2026-41418: medium-severity vulnerability in RARgames 4gaBoards
4ga Boards: User Enumeration via Timing Side-Channel in Authentication Endpoint
Published
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.3epss 0.3%
exploitation probability
0.3%top 76% of all CVEs
observed exploitation
nono source reports it
4ga Boards is a boards system for realtime project management. Prior to 3.3.5, 4ga Boards is vulnerable to user enumeration via a timing side-channel in the login endpoint (POST /api/access-tokens). When an invalid username/email is provided, the server responds immediately (~17ms average). When a valid username/email is provided with an incorrect password, the server first performs a bcrypt.compareSync() operation (~74ms average) before responding. This ~4.4× timing difference is trivially detectable even over a network — a single request suffices. This vulnerability is fixed in 3.3.5.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected products
RARgames · 4gaBoardsRelated CVEs — RARgames 4gaBoards
In the same product, most dangerous first.
CVE-2026-50186HIGH4gaBoards: Path Traversal leading to Arbitrary File Read and Deletion in Board ExportEPSS 0.6%CVE-2026-50191HIGH4gaBoards: Pre-Account Takeover via SSO Email LinkageEPSS 0.5%CVE-2026-41419HIGH4ga Boards: Import Path Traversal Leads to Arbitrary File ReadEPSS 0.5%CVE-2026-53959MEDIUM4gaBoards: Mass Information Disclosure (Internal PII Leakage) on /api/users to any authenticated userEPSS 0.4%CVE-2026-53958HIGH4gaBoards: SSO Pre-Account Takeover / Hijacking via Mass AssignmentEPSS 0.4%