CVE-2026-44255

Description

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta2, AuthenticationManager.check_user() in framework/wazuh/rbac/orm.py performs check_password_hash() only when the supplied username exists. A nonexistent username returns immediately, while a valid username causes an expensive bcrypt calculation. An unauthenticated remote attacker can compare authentication response times to enumerate valid Wazuh usernames and use that information in subsequent credential attacks. This issue is fixed in versions 4.14.6 and 5.0.0-beta2.

Traduire en français

Produits concernés

• wazuh
• Wazuh wazuh

Scores CVSS

Faiblesses (CWE)

• CWE-208

Références

• https://github.com/wazuh/wazuh/commit/5ecea7b38b998407cb0d205467dd247140a0f981 Patch
• https://github.com/wazuh/wazuh/pull/35757 Issue TrackingPatch
• https://github.com/wazuh/wazuh/releases/tag/v4.14.6 Release Notes
• https://github.com/wazuh/wazuh/releases/tag/v5.0.0-beta2 Release Notes
• https://github.com/wazuh/wazuh/security/advisories/GHSA-3978-44q9-9px9 ExploitVendor Advisory
• https://github.com/wazuh/wazuh/security/advisories/GHSA-3978-44q9-9px9 ExploitVendor Advisory

Ailleurs

• NVD
• CVE.org
• CIRCL Vulnerability-Lookup
• CERT-FR
• GitHub Advisories