User Enumeration Vulnerability in Proxmox Backup Server API Token Authentication

Details

Different user-facing error messages were returned in case of an API token authentication failing because the owning user being invalid, or the token itself being invalid. These error messages leaked information about the user existing or not.

This issue does not affect the security of API tokens themselves, but leaking the existence of valid usernames might allow collecting sensitive information about users and their infrastructure.

Fixed in

• proxmox-backup-server 4.1.4-1 (PBS 4.x)

• proxmox-backup-server 3.4.8-3 (PBS 3.x)