Quick answers
- Is CVE-2026-78551 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-78551 being exploited in the wild.
- How severe is CVE-2026-78551?
- Informational severity, published 24 August 2026.
- Which products and versions are affected?
- RansomLook RansomLook.
- Is there a fix for CVE-2026-78551?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-78551 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-78551?
- Check whether you run RansomLook. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability consists of multiple authentication weaknesses: (1) timing-based username enumeration—the application checked username existence before password verification, causing faster responses for invalid accounts and revealing valid usernames; (2) lack of rate limiting—the /login endpoint accepted unlimited failed attempts, enabling brute-force and credential-stuffing attacks; (3) CPU exhaustion DoS—each login attempt invokes an expensive password key-derivation function, allowing attackers to exhaust Gunicorn worker threads by sending high-rate requests. The attack requires only network access to the login endpoint and no authentication. Fixes include constant-time dummy-hash verification for nonexistent users, per-IP rate limiting via Redis (5 failures in 5 minutes = 1-hour block), and trusted X-Forwarded-For header handling in the reverse proxy.
Affected products
- RansomLook RansomLook
Timeline
- 2026-08-24: disclosed