CVE-2026-44255
Wazuh: Username Enumeration via Timing Side-Channel
CVSS Score
5.3
EPSS Score
0.0%
EPSS Percentile
0th
Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta2, AuthenticationManager.check_user() in framework/wazuh/rbac/orm.py performs check_password_hash() only when the supplied username exists. A nonexistent username returns immediately, while a valid username causes an expensive bcrypt calculation. An unauthenticated remote attacker can compare authentication response times to enumerate valid Wazuh usernames and use that information in subsequent credential attacks. This issue is fixed in versions 4.14.6 and 5.0.0-beta2.
| CWE | CWE-208 |
| Vendor | wazuh |
| Product | wazuh |
| Published | Aug 19, 2026 |
Stay Ahead of the Next One
Get instant alerts for wazuh wazuh
Be the first to know when new medium vulnerabilities affecting wazuh wazuh are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None
Affected Versions
wazuh / wazuh
>= 4.0.0, < 4.14.6 >= 5.0.0-beta1, < 5.0.0-beta2
References
github.com: https://github.com/wazuh/wazuh/security/advisories/GHSA-3978-44q9-9px9 github.com: https://github.com/wazuh/wazuh/pull/35757 github.com: https://github.com/wazuh/wazuh/commit/5ecea7b38b998407cb0d205467dd247140a0f981 github.com: https://github.com/wazuh/wazuh/releases/tag/v4.14.6 github.com: https://github.com/wazuh/wazuh/releases/tag/v5.0.0-beta2