CVE-2026-62860

Picsou is a self-hosted personal finance dashboard. In the affected login implementation, the /api/auth/login endpoint reveals whether a username exists through a timing discrepancy. In backend/src/main/java/com/picsou/controller/AuthController.java, AuthController.login() throws BadCredentialsException immediately for an unknown username, before passwordEncoder.matches(...), whereas an existing username with an incorrect password incurs the bcrypt comparison cost. Both cases return the same generic HTTP 401 response, but repeated latency measurements disclose valid usernames without credentials. Login rate limiting, a small user population, and deployments inaccessible from outside the local network limit practical exposure; the weakness does not itself read or modify account data, though enumerated usernames can assist credential stuffing or brute-force attacks. This issue is fixed in repository release 1.0.8.