CVE-2025-46736: Umbraco Makes User Enumeration Feasible Based on Timing of Login Response

The vulnerability allows user enumeration based on the timing of login responses. The provided patches (14fbd20665b453cbf094ccf4575b79a9fba07e03 and 34709be6cce9752dfa767dffbf551305f48839bc) clearly show modifications to the PostLogin method within the AuthenticationController.cs file. These changes involve adding a TimedScope to ensure that failed login attempts take a consistent amount of time, thereby preventing attackers from distinguishing between valid and invalid users based on response time. The PostLogin method is directly responsible for processing login requests and its response timing was the source of the vulnerability. The new GetLoginDuration method and the TimedScope class are part of the mitigation, not the vulnerability itself. The core vulnerable behavior was within PostLogin before these mitigations were applied.