5.3

CVE-2026-44255

Exploit

Wazuh: Username Enumeration via Timing Side-Channel

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta2, AuthenticationManager.check_user() in framework/wazuh/rbac/orm.py performs check_password_hash() only when the supplied username exists. A nonexistent username returns immediately, while a valid username causes an expensive bcrypt calculation. An unauthenticated remote attacker can compare authentication response times to enumerate valid Wazuh usernames and use that information in subsequent credential attacks. This issue is fixed in versions 4.14.6 and 5.0.0-beta2.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Wazuh ≫ Wazuh Version >= 4.0.0 < 4.14.6
Wazuh ≫ Wazuh Version 5.0.0 Update beta1
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.46% 0.382
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
security-advisories@github.com 5.3 3.9 1.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CWE-208 Observable Timing Discrepancy

Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not.

https://github.com/wazuh/wazuh/releases/tag/v4.14.6
Release Notes
https://github.com/wazuh/wazuh/releases/tag/v5.0.0-beta2
Release Notes
https://github.com/wazuh/wazuh/security/advisories/GHSA-3978-44q9-9px9
Vendor Advisory
Exploit
https://github.com/wazuh/wazuh/pull/35757
Patch
Issue Tracking
https://github.com/wazuh/wazuh/commit/5ecea7b38b998407cb0d205467dd247140a0f981
Patch