CVE-2026-8793 — Missing Brute-Force Protection on PaperCut NG Login Form

Summary

PaperCut NG's web administration interface does not implement any form of brute-force protection on its login endpoint. An unauthenticated attacker can submit an unlimited number of authentication attempts against any account without triggering account lockout, CAPTCHA challenges, or request rate-limiting.

When combined with CVE-2026-8794 (username enumeration via timing side-channel), this vulnerability enables a fully targeted attack: first enumerate valid account names silently, then perform unlimited login attempts against those accounts with no risk of detection or lockout at the application layer.

Technical Details

Affected Endpoint

POST /app HTTP/1.1
Host: <target>:9191
Content-Type: application/x-www-form-urlencoded

service=direct/1/Home/%24Form&inputUsername=admin&inputPassword=<password>

Observed Behaviour

Ten consecutive failed authentication attempts against the built-in admin account produced identical HTTP 200 responses with no behavioral change:

No account lockout
No CAPTCHA challenge
No progressive delay
No rate-limit headers (X-RateLimit-*, Retry-After)
No visible difference between attempt 1 and attempt 10
Proof of Concept:
for i in $(seq 1 10); do
  curl -s -o /dev/null -w "Attempt $i: HTTP %{http_code} — Time: %{time_total}s\n" \
    -X POST "http://<target>:9191/app" \
    -H "Origin: http://<target>:9191" \
    --data "service=direct/1/Home/%24Form&inputUsername=admin&inputPassword=wrongpassword$i"
done

All ten attempts return HTTP 200 with no observable difference in response time or content, confirming the absence of any throttling mechanism.

Attack Chain with CVE-2026-8794

This vulnerability is most impactful when chained with CVE-2026-8794:

Step 1 (CVE-2026-8794) — Enumerate valid usernames by measuring authentication response times. Valid usernames take ~2.1 seconds longer on average than invalid ones, due to bcrypt executing only when the account exists. The two timing distributions show zero overlap across 30 samples. Step 2 (CVE-2026-8793) — Perform unlimited password attempts against confirmed valid accounts. Common password lists, credential dumps, or targeted guesses can be submitted at full network speed with no lockout risk. Impact

An unauthenticated attacker with network access to TCP/9191 can:

Submit unlimited password guesses against any account with no throttling Automate credential-stuffing attacks using leaked password databases Execute targeted attacks against the built-in admin account or enumerated user accounts

PaperCut NG is widely deployed in corporate and educational environments where the web interface manages print queues, billing, and user access. Compromise of an administrative account provides full control over print infrastructure and user data.

Remediation

For administrators (interim mitigations):

Restrict network access to TCP/9191 to trusted hosts only Enforce strong, unique passwords on all PaperCut accounts Ensure account lockout is configured at the upstream identity provider (AD/LDAP) Monitor access logs for unusual patterns of failed authentication

For the vendor:

Implement application-layer rate-limiting or progressive lockout on the login endpoint Optionally introduce CAPTCHA after a configurable threshold of failed attempts Add Retry-After response headers when rate limits are applied Timeline

Date Event May 9, 2026 Initial report submitted to PaperCut Security Team May 10, 2026 Acknowledgment received May 2026 CVE-2026-8793 assigned by PaperCut (CNA) August 2026 Patch released — PaperCut NG 26.0.3 August 2026 Public disclosure coordinated with vendor References CVE-2026-8793 on cve.org CVE-2026-8794 — Chained vulnerability CWE-307 PaperCut NG Product Page

Disclosed in accordance with responsible disclosure principles. Full technical details were shared with the PaperCut Security Team prior to public release.

Researcher: Vivien LEBAS — @Hazaz