This site currently shows sample data for demonstration.
BDVDB
বাংলা

Vulnerabilities

CVE-2026-41418 | BDVDB-2026-328964 Detail

RARgames4gaBoards

Description#

4ga Boards is a boards system for realtime project management. Prior to 3.3.5, 4ga Boards is vulnerable to user enumeration via a timing side-channel in the login endpoint (POST /api/access-tokens). When an invalid username/email is provided, the server responds immediately (~17ms average). When a valid username/email is provided with an incorrect password, the server first performs a bcrypt.compareSync() operation (~74ms average) before responding. This ~4.4× timing difference is trivially detectable even over a network — a single request suffices. This vulnerability is fixed in 3.3.5.

Impact#

Per CVSS v3.1: confidentiality impact low, integrity impact none, availability impact none. Attack vector: network.

Weaknesses#

  • CWE-208 Observable Timing Discrepancy

References#

Exploit#

No public exploit known

History#

  1. Version 1Record published in the CVE List.