CVE-2026-109379: Cockpit CMS 2.14.1 Account Enumeration via Timing Discrepancy in /auth/check
Cockpit CMS 2.14.1 contains an observable timing discrepancy vulnerability that allows unauthenticated attackers to enumerate accounts due to an incomplete timing fix in /auth/check. Attackers can post login attempts and measure response times, since existing accounts incur two bcrypt operations versus one, revealing valid usernames and email addresses.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote attacker able to send login attempts to the /auth/check endpoint can measure response times to infer whether submitted usernames or email addresses correspond to existing accounts.
What information can an attacker obtain?
The timing difference can reveal valid usernames and email addresses. The provided information does not indicate that the issue exposes passwords or permits account login.
Is user interaction or prior access required?
No. The issue is remotely reachable, requires no privileges, and does not require user interaction.
How does the timing difference identify an account?
Login attempts for existing accounts perform two bcrypt operations, while attempts for non-existing accounts perform one. Measuring the resulting response-time difference allows attackers to distinguish likely valid account identifiers.