CVE-2026-78551
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk34th percentile - higher than 34% of all known CVEs
Summary
RansomLook contains multiple weaknesses in its authentication endpoint that allow an unauthenticated remote attacker to enumerate valid usernames, perform unrestricted password-guessing attacks, and potentially exhaust application worker resources. The issue stems from timing differences for existing vs. non-existing usernames and lack of rate limiting on failed login attempts.
Risk Assessment
An attacker can obtain a list of valid accounts, conduct brute-force or dictionary attacks, and potentially overload the application causing denial of service (DoS) affecting all users.
Recommendation
Update RansomLook immediately to a version with fixes: always perform password verification with a random dummy hash for non-existent users, implement rate limiting (5 failed attempts in 5 minutes, 1-hour block), and configure trusted X-Forwarded-For handling.
Other vulnerabilities in RansomLook
See all- CVE-2026-78555Critical
RansomLook exposed complete API keys in the HTML source of the authenticated /admin/apikeys administration page. Although the interface displayed only a shortened representation of each key, the full token was embedded in hidden form fields used by the enable/disable, private-access, and delete actions.
- CVE-2026-78387Critical
RansomLook contains an authorization weakness in the web-based configuration editor exposed through the /admin/config endpoint. The endpoint requires an authenticated session but does not perform an explicit privilege or administrator authorization check before allowing access to configuration-management functionality. An authenticated low-privileged user can modify the config/generic.json file, changing notification, LDAP, SMTP, and general application settings.
- CVE-2026-78372Critical
RansomLook does not consistently enforce authorization checks when accessing groups, markets, and ransom notes marked as private. An unauthenticated or otherwise unauthorized remote attacker can access information associated with private entities through several web views and API endpoints. The /compare functionality can also be queried directly with the name of a private entity, allowing an unauthorized user to retrieve information such as post counts, mirror totals, and uptime even when the entity is excluded from the normal user interface.
- CVE-2026-78370Critical
RansomLook contains an authorization flaw in its legacy database export functionality that can allow unauthenticated remote users to retrieve information intended to remain private. The /export/<database> endpoint permits selected internal databases to be exported without requiring authentication. While limited filtering is performed for some entity databases, other exportable databases are returned directly without consistently applying the application's private-entity access restrictions. As a result, information associated with groups, markets, posts, or other records marked as private may be included in an export accessible to an unauthenticated requester.
- CVE-2026-78553High
RansomLook created its Flask session-signing key without restricting file permissions, resulting in permissions like 0644. Other local users can read the cryptographic secret, allowing them to generate valid session cookies and impersonate authenticated users, including administrators.
- CVE-2026-78391High
RansomLook contains a stored cross-site scripting (XSS) vulnerability in the cryptocurrency wallet detail view. Cryptocurrency addresses and blockchain names from external sources, including the public crowd-sourced ransomwhe.re feed, were stored without sufficient validation and embedded directly into an inline JavaScript onclick handler. Although Jinja HTML autoescaping was applied, it does not protect against untrusted data in a JavaScript string inside an HTML attribute, allowing crafted addresses to execute arbitrary JavaScript.
- CVE-2026-78386High
RansomLook exposes sensitive operator-side scraping configuration through multiple unauthenticated API responses. Location records associated with ransomware groups and markets are returned largely verbatim to unauthenticated callers whenever the location itself is not marked as private. These records may contain internal fields such as authentication headers, session cookies, init scripts, and browser details.
- CVE-2026-78385High
RansomLook contains insufficient resource validation in the analysis PDF generation functionality. Analysis documents are converted from Markdown to HTML and passed to WeasyPrint for PDF rendering. Prior to the fix, WeasyPrint used its default URL fetcher, allowing resource references contained in an analysis to be resolved without restrictions.
- CVE-2026-78381High
RansomLook contains a path traversal vulnerability in the handling of the screen field associated with group posts. The GroupPost.get API handler concatenates the database-controlled screen value directly with the application's source/ directory and opens the resulting path without verifying that the resolved file remains within the intended directory. A malicious upstream instance can provide traversal sequences such as ../config/generic.json, leading to arbitrary file read.
- CVE-2026-78380High
The vulnerability in RansomLook is due to the failure to enforce the privacy status of ransomware groups and markets when distributing newly collected victim posts to external notification channels. The post-processing logic only checks whether an individual post is marked private, but does not verify whether the group or market to which the post belongs is configured as private. As a result, victim information from private groups or markets may be automatically published through enabled Rocket.Chat, Mastodon, Bluesky, and email notification channels, as well as added to the public MISP feed.
Original NVD description (English source)
RansomLook contains multiple weaknesses in its authentication endpoint that allow an unauthenticated remote attacker to enumerate valid usernames, perform unrestricted password-guessing attacks, and potentially exhaust application worker resources. For local authentication, the login implementation previously checked whether a submitted username existed before invoking the password hash verification function. Requests containing a nonexistent username therefore returned significantly faster than requests for valid accounts, for which the computationally expensive password verification routine was executed. A remote attacker could measure these response-time differences to determine which usernames correspond to valid RansomLook accounts. In addition, the /login endpoint did not restrict the number or frequency of failed authentication attempts. An attacker could consequently perform password brute-force, dictionary, password-spraying, or credential-stuffing attacks against known accounts without server-side throttling. For valid usernames, each authentication attempt also invokes the password key-derivation function, which consumes a significant amount of CPU time. A sufficiently high rate of login attempts could therefore occupy the application's synchronous Gunicorn workers and cause a denial of service affecting the entire application. The issue has been addressed by always performing password verification using a randomly generated dummy password hash when the supplied username does not exist, eliminating the username-dependent timing discrepancy. Failed authentication attempts are additionally rate-limited per client IP address using Valkey/Redis, with five failed attempts within five minutes resulting in a one-hour block. The reverse-proxy configuration was also updated so that the application derives the client address from a trusted X-Forwarded-For value that cannot be overridden by a client-supplied header.