CVE-2026-109379

EUVD-2026-97877
Cockpit CMS 2.14.1 contains an observable timing discrepancy vulnerability that allows unauthenticated attackers to enumerate accounts due to an incomplete timing fix in /auth/check. Attackers can post login attempts and measure response times, since existing accounts incur two bcrypt operations versus one, revealing valid usernames and email addresses.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.3 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Common Weakness Enumeration
References
https://github.com/Cockpit-HQ/Cockpit
https://github.com/Cockpit-HQ/Cockpit/blob/2.14.1/modules/App/Controller/Auth.php
https://github.com/Cockpit-HQ/Cockpit/blob/2.14.1/modules/App/Helper/Auth.php
https://github.com/Cockpit-HQ/Cockpit/commit/5d65ae7b63a261a63e8809e5fba857ef3eadb2ac
https://github.com/Cockpit-HQ/Cockpit/issues/328
https://www.vulncheck.com/advisories/cockpit-cms-2.14.1-account-enumeration-via-timing-discrepancy-in-auth-check