CVE-2026-109379

Received Received - Intake

Observable Timing Discrepancy in Cockpit CMS

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description

Cockpit CMS 2.14.1 contains an observable timing discrepancy vulnerability that allows unauthenticated attackers to enumerate accounts due to an incomplete timing fix in /auth/check. Attackers can post login attempts and measure response times, since existing accounts incur two bcrypt operations versus one, revealing valid usernames and email addresses.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-12

Last Modified

2026-10-12

Generated

2026-10-13

AI Q&A

2026-10-13

EPSS Evaluated

N/A

NVD

CVE-2026-109379

Affected Vendors & Products

Vendor	Product	Version / Range
cockpit-hq	cockpit	2.14.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-208	Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not.

Attack-Flow Graph

Executive Summary

Cockpit CMS 2.14.1 has a timing discrepancy flaw in the /auth/check endpoint. Unauthenticated attackers can exploit this by sending login attempts and measuring server response times. Valid accounts take longer to process due to an extra bcrypt operation, allowing attackers to enumerate usernames and email addresses.

Detection Guidance

To detect this vulnerability, monitor response times from the /auth/check endpoint. Send login attempts to the endpoint and measure the time taken for responses. Valid accounts will show longer response times due to two bcrypt operations compared to one for invalid accounts.

Impact Analysis

Attackers could identify valid accounts on your Cockpit CMS instance, enabling targeted phishing attacks or brute-force attempts. This compromises user privacy and increases the risk of unauthorized access to sensitive data managed by the CMS.

Compliance Impact

This vulnerability may violate data protection requirements by exposing user account information, potentially leading to unauthorized access. GDPR and HIPAA mandate safeguards against such data leaks, and this flaw could result in non-compliance if exploited.

Mitigation Strategies

Immediately upgrade Cockpit CMS to a version that includes the complete timing fix for the /auth/check endpoint. If an upgrade is not immediately possible, consider disabling the /auth/check endpoint or implementing rate limiting to reduce the effectiveness of timing attacks.

Hi! I’m here to help you understand CVE-2026-109379. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70