# CVE-2026-78551: RansomLook authentication endpoint enumeration and DoS

Source: https://junglewise.ai/threats/cve-2026-78551-ransomlook-authentication-endpoint-enumeration-and-dos  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-24. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-78551 · Severity: info · Published 2026-08-24

RansomLook is a web application used for monitoring ransom threat actor activities. Its login system contained flaws that allowed attackers to discover valid usernames through timing analysis, attempt unlimited password guesses against known accounts, and potentially crash the application by overwhelming its worker processes with fake login attempts. This could lead to account takeover and service disruption.

Technologies: [RansomLook](https://junglewise.ai/threats/technologies/ransomlook). Vendors: [RansomLook](https://junglewise.ai/threats/vendors/ransomlook).

## Quick answers

**Is CVE-2026-78551 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-78551 being exploited in the wild.

**How severe is CVE-2026-78551?** Informational severity, published 24 August 2026.

**Which products and versions are affected?** RansomLook RansomLook.

**Is there a fix for CVE-2026-78551?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-78551 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-78551?** Check whether you run RansomLook. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability consists of multiple authentication weaknesses: (1) timing-based username enumeration—the application checked username existence before password verification, causing faster responses for invalid accounts and revealing valid usernames; (2) lack of rate limiting—the /login endpoint accepted unlimited failed attempts, enabling brute-force and credential-stuffing attacks; (3) CPU exhaustion DoS—each login attempt invokes an expensive password key-derivation function, allowing attackers to exhaust Gunicorn worker threads by sending high-rate requests. The attack requires only network access to the login endpoint and no authentication. Fixes include constant-time dummy-hash verification for nonexistent users, per-IP rate limiting via Redis (5 failures in 5 minutes = 1-hour block), and trusted X-Forwarded-For header handling in the reverse proxy.

## Affected products

- RansomLook RansomLook

## Timeline

- 2026-08-24: disclosed

## Related threats

- [RansomLook API key exposure in HTML source](https://junglewise.ai/threats/cve-2026-78555-ransomlook-api-key-exposure-in-html-source)
- [RansomLook insecure Flask session key file permissions](https://junglewise.ai/threats/cve-2026-78553-ransomlook-insecure-flask-session-key-file-permissions)
- [RansomLook API information disclosure via unauthenticated location records](https://junglewise.ai/threats/cve-2026-78386-ransomlook-api-information-disclosure-via-unauthenticated)
- [RansomLook insufficient resource validation in PDF generation](https://junglewise.ai/threats/cve-2026-78385-ransomlook-insufficient-resource-validation-in-pdf-generation)
- [RansomLook Redis glob pattern injection](https://junglewise.ai/threats/cve-2026-78378-ransomlook-redis-glob-pattern-injection)