CVE-2026-44255
Received Received - Intake

Authentication Timing Attack in Wazuh

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: GitHub, Inc.

Description
Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta2, AuthenticationManager.check_user() in framework/wazuh/rbac/orm.py performs check_password_hash() only when the supplied username exists. A nonexistent username returns immediately, while a valid username causes an expensive bcrypt calculation. An unauthenticated remote attacker can compare authentication response times to enumerate valid Wazuh usernames and use that information in subsequent credential attacks. This issue is fixed in versions 4.14.6 and 5.0.0-beta2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-44255
EUVD
EUVD-2026-62558

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
wazuh wazuh From 4.0.0 (inc) to 4.14.6 (inc)
wazuh wazuh to 5.0.0-beta2 (inc)
wazuh wazuh_manager From 4.0.0 (inc)
wazuh wazuh_manager 4.14.6
wazuh wazuh_manager 5.0.0-beta2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-208 Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-44255 is a timing side-channel vulnerability in Wazuh affecting versions 4.0.0 to 4.14.5 and 5.0.0-beta2. The issue occurs in the AuthenticationManager.check_user() function where response times differ significantly between valid and invalid usernames. Valid usernames trigger a bcrypt hash check taking ~125ms, while invalid ones return immediately (~0.0006ms). Attackers can exploit this timing difference to enumerate valid usernames without authentication.

Detection Guidance

To detect this vulnerability, monitor authentication response times for Wazuh Manager. Measure the time taken for failed login attempts with valid and invalid usernames. A significant timing difference (approximately 125ms vs 0.0006ms) indicates the vulnerability is present.

Impact Analysis

This vulnerability allows unauthenticated remote attackers to identify valid Wazuh usernames by measuring authentication response times. Once valid usernames are known, attackers can use this information for credential stuffing attacks or targeted brute-force attempts. The low attack complexity and no privilege requirements make exploitation straightforward for attackers.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA but may indirectly impact security controls. The timing side-channel allows username enumeration, which could aid credential attacks. Organizations must ensure authentication systems do not leak timing information to maintain security posture required by these regulations.

Mitigation Strategies

Upgrade Wazuh Manager to version 4.14.6 or later. If upgrading is not immediately possible, implement rate limiting on authentication endpoints and monitor for unusual timing patterns in login attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-44255. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart