Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta2, AuthenticationManager.check_user() in framework/wazuh/rbac/orm.py performs check_password_hash() only when the supplied username exists. A nonexistent username returns immediately, while a valid username causes an expensive bcrypt calculation. An unauthenticated remote attacker can compare authentication response times to enumerate valid Wazuh usernames and use that information in subsequent credential attacks. This issue is fixed in versions 4.14.6 and 5.0.0-beta2.
Fix
Patch, vendor advisory and mitigation references on NVD 4
- https://github.com/wazuh/wazuh/commit/5ecea7b38b998407cb0d205467dd247140a0f981 Patch
- https://github.com/wazuh/wazuh/pull/35757 Issue Tracking, Patch
- https://github.com/wazuh/wazuh/security/advisories/GHSA-3978-44q9-9px9 Exploit, Vendor Advisory
- https://github.com/wazuh/wazuh/security/advisories/GHSA-3978-44q9-9px9 Exploit, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 5.3 · wazuhNVD modified 2026-10-26 11:10
Affected (CPE criteria) 2
cpe:2.3:a:wazuh:wazuh:*:*:*:*:*:*:*:*cpe:2.3:a:wazuh:wazuh:5.0.0:beta1:*:*:*:*:*:*
References 6
- https://github.com/wazuh/wazuh/commit/5ecea7b38b998407cb0d205467dd247140a0f981 Patch
- https://github.com/wazuh/wazuh/pull/35757 Issue Tracking, Patch
- https://github.com/wazuh/wazuh/releases/tag/v4.14.6 Release Notes
- https://github.com/wazuh/wazuh/releases/tag/v5.0.0-beta2 Release Notes
- https://github.com/wazuh/wazuh/security/advisories/GHSA-3978-44q9-9px9 Exploit, Vendor Advisory
- https://github.com/wazuh/wazuh/security/advisories/GHSA-3978-44q9-9px9 Exploit, Vendor Advisory