CVE-2026-109379
5.3MediumPublished 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-208
Impact
Unauthenticated remote attackers can enumerate valid usernames and email addresses. They only need network access to the /auth/check endpoint to measure response times.
Root cause
An incomplete timing attack mitigation in /auth/check executes two bcrypt hash operations for existing accounts versus one for nonexistent accounts.
Affected systems
Cockpit CMS 2.14.1
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Fix & remediation
Apply commit 5d65ae7b63a261a63e8809e5fba857ef3eadb2ac or upgrade past 2.14.1 once a release is published. As an interim mitigation, restrict access to the /auth/check endpoint or place it behind rate limiting and WAF rules.
$ git pull origin mainAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Cockpit CMS 2.14.1 contains an observable timing discrepancy vulnerability that allows unauthenticated attackers to enumerate accounts due to an incomplete timing fix in /auth/check. Attackers can post login attempts and measure response times, since existing accounts incur two bcrypt operations versus one, revealing valid usernames and email addresses.
References
- https://github.com/Cockpit-HQ/Cockpit
- https://github.com/Cockpit-HQ/Cockpit/blob/2.14.1/modules/App/Controller/Auth.php
- https://github.com/Cockpit-HQ/Cockpit/blob/2.14.1/modules/App/Helper/Auth.php
- https://github.com/Cockpit-HQ/Cockpit/commit/5d65ae7b63a261a63e8809e5fba857ef3eadb2ac
- https://github.com/Cockpit-HQ/Cockpit/issues/328
- https://www.vulncheck.com/advisories/cockpit-cms-2.14.1-account-enumeration-via-timing-discrepancy-in-auth-check