CVE-2026-44255

Katalog CVE

CVSS 5.3 · Medium EPSS 0,62%

Kerentanan Observable Timing Discrepancy pada wazuh. Skor CVSS 3.1 5.3 (Medium) menurut github.com.

Deskripsi (NVD)

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta2, AuthenticationManager.check_user() in framework/wazuh/rbac/orm.py performs check_password_hash() only when the supplied username exists. A nonexistent username returns immediately, while a valid username causes an expensive bcrypt calculation. An unauthenticated remote attacker can compare authentication response times to enumerate valid Wazuh usernames and use that information in subsequent credential attacks. This issue is fixed in versions 4.14.6 and 5.0.0-beta2.

Rincian

Terbit di NVD

19 Agustus 2026

Terakhir diubah

18 September 2026

Status NVD

Analyzed

CVSS 3.1

5.3 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-208: Observable Timing Discrepancy

EPSS (30 hari)

0,62% peluang dieksploitasi; lebih tinggi dari 48,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/wazuh/wazuh/security/advisories/GHSA-3978-44q9-9px9 exploit · advisory vendor
• https://github.com/wazuh/wazuh/commit/5ecea7b38b998407cb0d205467dd247140a0f981 patch
• https://github.com/wazuh/wazuh/pull/35757 issue tracking · patch
• https://github.com/wazuh/wazuh/releases/tag/v4.14.6 release notes
• https://github.com/wazuh/wazuh/releases/tag/v5.0.0-beta2 release notes