CVEvulnerability
CVE-2026-44255
5.3 MEDIUM
Official page ↗
- Status
- Analyzed
- Published
- 2026-08-19
- Last modified
- 2026-10-26
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 5.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weaknesses
- CWE-208
Description
Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta2, AuthenticationManager.check_user() in framework/wazuh/rbac/orm.py performs check_password_hash() only when the supplied username exists. A nonexistent username returns immediately, while a valid username causes an expensive bcrypt calculation. An unauthenticated remote attacker can compare authentication response times to enumerate valid Wazuh usernames and use that information in subsequent credential attacks. This issue is fixed in versions 4.14.6 and 5.0.0-beta2.
Affected configurations
• wazuh wazuh (>= 4.0.0 < 4.14.6)
• wazuh wazuh 5.0.0
Related
Weakness · CWE (1)
- CWE-208 Observable Timing Discrepancy weakness
References
- https://github.com/wazuh/wazuh/commit/5ecea7b38b998407cb0d205467dd247140a0f981 Patch
- https://github.com/wazuh/wazuh/pull/35757 Issue Tracking, Patch
- https://github.com/wazuh/wazuh/releases/tag/v4.14.6 Release Notes
- https://github.com/wazuh/wazuh/releases/tag/v5.0.0-beta2 Release Notes
- https://github.com/wazuh/wazuh/security/advisories/GHSA-3978-44q9-9px9 Exploit, Vendor Advisory
- https://github.com/wazuh/wazuh/security/advisories/GHSA-3978-44q9-9px9 Exploit, Vendor Advisory