216.73.217.98

CVE-2026-27480

· Published 21/02/2026 10:16 · Modified 21/02/2026 10:16

Labels: CVE-2026-27480 2026-02-21CVE-2026-27480CWE-204[email protected]

Essential information

Published
21/02/2026 10:16
Modified
21/02/2026 10:16
Author
—
Creator
—
CVSS
5.3 MEDIUM (v3.1)
CISA KEV
No
CWE
—
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CVSS metrics

Description

Static Web Server (SWS) is a production-ready web server suitable for static web files or assets. In versions 2.1.0 through 2.40.1, a timing-based username enumeration vulnerability in Basic Authentication allows attackers to identify valid users by exploiting early responses for invalid usernames, enabling targeted brute-force or credential-stuffing attacks. SWS checks whether a username exists before verifying the password, causing valid usernames to follow a slower code path (e.g., bcrypt hashing) while invalid usernames receive an immediate 401 response. This timing discrepancy allows attackers to enumerate valid accounts by measuring response-time differences. This issue has been fixed in version 2.41.0.

NVD status

Status
Received — CVE has been recently published to the CVE List and has been received by the NVD.
Source
[email protected]
NVD
View on NVD

Affected products (CPE)

ProductCPE
static web server / static web server cpe:2.3:a:static_web_server:static_web_server:2.1.0-2.40.1:*:*:*:*:*:*:*
static web server / static web server cpe:2.3:a:static_web_server:static_web_server:2.41.0:*:*:*:*:*:*:*

References