---
id: CVE-2026-8794
title: >-
  PaperCut NG/MF contains an observable timing discrepancy in its authentication
  component
summary: >-
  PaperCut NG/MF contains an observable timing discrepancy in its authentication
  component. An unauthenticated remote attacker can exploit this vulnerability
  to perform username enumeration by measuring response times during login
  attempts…
severity: none
cwe:
  - CWE-208
published: '2026-08-03'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T16:03:59.890'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-8794'
references:
  - url: >-
      https://www.papercut.com/kb/Main/papercut-ng-mf-security-bulletin-3-aug-2026/
    label: eb41dac7-0af8-4f84-9f6d-0272772514f4
tags:
  - nvd
  - exploit-available
epss: 0.00676
epssPercentile: 0.50118
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/H4zaz/CVE-2026-8794'
  checkedAt: '2026-09-25T08:21:20.375Z'
exploitAvailable: true
ingestedAt: '2026-09-09T16:14:05.511Z'
---

## Overview

PaperCut NG/MF contains an observable timing discrepancy in its authentication component. An unauthenticated remote attacker can exploit this vulnerability to perform username enumeration by measuring response times during login attempts. The system executes a password hash comparison only when a valid account is supplied, creating a measurable timing oracle that reveals account existence.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.