CVE-2026-53525

Received Received - Intake

Authentication Timing Attack in WeeChat Relay

Publication date: 2026-08-21

Last updated on: 2026-08-21

Assigner: GitHub, Inc.

Description

WeeChat (Wee Enhanced Environment for Chat) is a free chat client. In versions 0.3.1 through 4.9.0, the WeeChat relay authentication uses non-constant-time string comparison functions (weechat_strcasecmp and strcmp) to verify password hashes and plaintext passwords. An attacker can exploit timing differences to extract the server-computed hash character by character, then authenticate using the correct hash without knowing the password. Version 4.9.1 fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-21

Last Modified

2026-08-21

Generated

2026-08-22

AI Q&A

2026-08-22

EPSS Evaluated

N/A

NVD

CVE-2026-53525

Affected Vendors & Products

Vendor	Product	Version / Range
weechat	weechat	From 0.3.1 (inc) to 4.9.0 (inc)
weechat	weechat	4.9.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-208	Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not.

Attack-Flow Graph

Executive Summary

This vulnerability affects WeeChat versions 0.3.1 through 4.9.0. It involves the relay authentication process using non-constant-time string comparison functions (weechat_strcasecmp and strcmp) to verify passwords. Attackers can exploit timing differences to extract the server-computed hash character by character, then authenticate using the correct hash without knowing the actual password.

Detection Guidance

This vulnerability cannot be reliably detected using standard commands due to its timing-based nature. The issue involves non-constant-time string comparisons in WeeChat's relay authentication, which requires specialized timing analysis tools to detect potential exploitation attempts.

Impact Analysis

An attacker could gain unauthorized access to the WeeChat relay by exploiting timing differences in password verification. This could allow them to read private conversations, send messages as the victim, or perform other actions permitted by the relay's permissions.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating confidentiality requirements in GDPR and HIPAA. Organizations using affected WeeChat versions may face compliance violations if user data is exposed due to this flaw.

Mitigation Strategies

Upgrade WeeChat to version 4.9.1 or later to fix the timing attack vulnerability in relay authentication.

Hi! I’m here to help you understand CVE-2026-53525. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70