CVE-2026-44255

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-44255
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-44255.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-44255
Aliases
  • GHSA-3978-44q9-9px9
Published
2026-08-19T16:15:19Z
Modified
2026-09-20T11:45:51Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
Wazuh: Username Enumeration via Timing Side-Channel
Details

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta2, AuthenticationManager.check_user() in framework/wazuh/rbac/orm.py performs check_password_hash() only when the supplied username exists. A nonexistent username returns immediately, while a valid username causes an expensive bcrypt calculation. An unauthenticated remote attacker can compare authentication response times to enumerate valid Wazuh usernames and use that information in subsequent credential attacks. This issue is fixed in versions 4.14.6 and 5.0.0-beta2.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-208"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44255.json"
}
References

Affected packages

Git / github.com/wazuh/wazuh

Affected ranges

Type
GIT
Repo
https://github.com/wazuh/wazuh
Events
Introduced
8c2c62a6e9dcbcf2c792f7924e8cfdb26842820b
Fixed
44c2925b46bd058d2426bd44ed1b3e5d7b7b03b4
Introduced
cddd833300cb5af494ba7dab31192bae649eb184
Fixed
5ecea7b38b998407cb0d205467dd247140a0f981
Fixed
b58b3b2552497639b1b2a2b23e8de87e4ce9cf02
Database specific
Show details 
{
    "cpe": [
        "cpe:2.3:a:wazuh:wazuh:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:wazuh:wazuh:5.0.0:beta1:*:*:*:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "4.0.0"
        },
        {
            "fixed": "4.14.6"
        },
        {
            "introduced": "5.0.0-beta1"
        },
        {
            "last_affected": "5.0.0-beta1"
        }
    ],
    "source": [
        "CPE_RANGE",
        "CPE_STRING",
        "REFERENCES"
    ]
}

Affected versions

5.*
5.0.0-beta1
v5.*
v5.0.0-beta1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-44255.json"