Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.9
CVE-2026-61503: Rejetto HFS Returns Sensitive Login Information
CVE-2026-61503 · published 3 months ago
Summary
Rejetto HFS, a file sharing software, returns information about existing usernames to anyone who tries to log in. This makes it easier for attackers to guess valid usernames and try to access the system. To protect your system, update to a version of Rejetto HFS that is not vulnerable.
What to do
- Update rejetto hfs to version 3.2.1 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| rejetto | hfs | < 3.2.1 |
Original advisory text
Rejetto HFS < 3.2.1 Username Enumeration via Login Response Differences
Rejetto HFS 3.0.0 through 3.2.0 returns observably different responses from its login endpoint depending on whether the submitted username exists. A remote unauthenticated attacker can use this to confirm valid account names, including the default admin account, facilitating password-guessing and session-forgery attacks.
References
- https://github.com/rejetto/hfs/releases/tag/v3.2.1
- https://www.vulncheck.com/advisories/rejetto-hfs-username-enumeration-via-login-...
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/61xxx/CVE-2026-61503... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-61503 Vendor Advisory
- https://github.com/rejetto/hfs Product
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Type
CWE-204Observable Response Discrepancy
Timeline
Published13 Jul 2026
Updated4 Nov 2026
First seen13 Jul 2026
Track software like this
Free during beta