# CVE-2026-41418

> Vulnerability · severity: **MEDIUM** (CVSS 5.3).

## Description

4ga Boards is a boards system for realtime project management. Prior to 3.3.5, 4ga Boards is vulnerable to user enumeration via a timing side-channel in the login endpoint (POST /api/access-tokens). When an invalid username/email is provided, the server responds immediately (~17ms average). When a valid username/email is provided with an incorrect password, the server first performs a bcrypt.compareSync() operation (~74ms average) before responding. This ~4.4× timing difference is trivially detectable even over a network — a single request suffices. This vulnerability is fixed in 3.3.5.

## Key facts

- **CVE ID:** CVE-2026-41418
- **Published:** 2026-04-24
- **CVSS severity:** MEDIUM
- **CVSS base score:** 5.3
- **CWE codes:** CWE-208

## Primary sources

- NIST NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-41418

## Citation

> AI Analytics. CVE-2026-41418. Retrieved 2026-08-17 from https://api.ai-analytics.org/cve/CVE-2026-41418. Derived from NIST NVD. Licensed CC0.

---

*[Dataset catalog](https://api.ai-analytics.org/datasets/) · [AI Analytics](https://api.ai-analytics.org/) · CC0 1.0*