CVE-2026-44255

MediumCVSS 5.3/10Last modified Oct 26, 2026

Description

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta2, AuthenticationManager.check_user() in framework/wazuh/rbac/orm.py performs check_password_hash() only when the supplied username exists. A nonexistent username returns immediately, while a valid username causes an expensive bcrypt calculation. An unauthenticated remote attacker can compare authentication response times to enumerate valid Wazuh usernames and use that information in subsequent credential attacks. This issue is fixed in versions 4.14.6 and 5.0.0-beta2.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-208

Affected software

Vendor	Product	Versions
wazuh	wazuh	>= 4.0.0, < 4.14.6; >= 5.0.0-beta1, < 5.0.0-beta2

References

https://github.com/wazuh/wazuh/commit/5ecea7b38b998407cb0d205467dd247140a0f981Patch
https://github.com/wazuh/wazuh/pull/35757Issue Tracking, Patch
https://github.com/wazuh/wazuh/releases/tag/v4.14.6Release Notes
https://github.com/wazuh/wazuh/releases/tag/v5.0.0-beta2Release Notes
https://github.com/wazuh/wazuh/security/advisories/GHSA-3978-44q9-9px9Exploit, Vendor Advisory
https://github.com/wazuh/wazuh/security/advisories/GHSA-3978-44q9-9px9Exploit, Vendor Advisory

Timeline

Published: Aug 19, 2026
Last modified: Oct 26, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-442565.3Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.4.0 until 4.14.6 and 5.0.0-beta2, api/a CVE-2026-442579.3efw4.X is an Enterprise Framework for Web. Prior to 4.08.010, efw.file.FileManager.unZip writes zip entries to disk using new File(baseDir, CVE-2026-442589.3efw4.X is an Enterprise Framework for Web. Prior to 4.08.010, the elfinder_checkRisk function validates target and targets for path traversa CVE-2026-442594.6efw4.X is an Enterprise Framework for Web. Prior to 4.08.010, the previewServlet serves files with their detected MIME type based on file ex CVE-2026-44266.5A flaw was found in libarchive. An Undefined Behavior vulnerability exists in the zisofs decompression logic, caused by improper validation CVE-2026-442608.1efw4.X is an Enterprise Framework for Web. Prior to 4.08.010, the readonly flag set on the <efw:elFinder> JSP tag is intended to prevent fil CVE-2026-442629.4Scramble generates API documentation for Laravel project. From 0.13.2 to before 0.13.22, when documentation endpoints are publicly accessibl CVE-2026-442634.3Weblate is a web based localization tool. Prior to version 5.17.1, the screenshots, tasks, and component link API allowed for the enumeratio CVE-2026-442644.3Weblate is a web based localization tool. Prior to version 5.17.1, the Markdown renderer used in user comments and other user-provided conte CVE-2026-442657.4Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, Elo's programmatic AST API accepts arbitrary values from J CVE-2026-442669.8Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, the Ruby backend in src/compilers/ruby.ts embeds attacker-CVE-2026-442679.8Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, plain Elo strings supplied to defaultFormats.elo.parse(),