5.3

CVE-2026-44255

Wazuh: Username Enumeration via Timing Side-Channel

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta2, AuthenticationManager.check_user() in framework/wazuh/rbac/orm.py performs check_password_hash() only when the supplied username exists. A nonexistent username returns immediately, while a valid username causes an expensive bcrypt calculation. An unauthenticated remote attacker can compare authentication response times to enumerate valid Wazuh usernames and use that information in subsequent credential attacks. This issue is fixed in versions 4.14.6 and 5.0.0-beta2.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
Herstellerwazuh
≫
Produkt wazuh
Version >= 4.0.0, < 4.14.6
Status affected
Version >= 5.0.0-beta1, < 5.0.0-beta2
Status affected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.46% 0.382
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
security-advisories@github.com 5.3 3.9 1.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CWE-208 Observable Timing Discrepancy

Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not.

https://github.com/wazuh/wazuh/releases/tag/v4.14.6
https://github.com/wazuh/wazuh/releases/tag/v5.0.0-beta2
https://github.com/wazuh/wazuh/security/advisories/GHSA-3978-44q9-9px9
https://github.com/wazuh/wazuh/pull/35757
https://github.com/wazuh/wazuh/commit/5ecea7b38b998407cb0d205467dd247140a0f981