CVE-2026-44255: Wazuh: Username Enumeration via Timing Side-Channel
Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta2, AuthenticationManager.checkuser() in framework/wazuh/rbac/orm.py performs checkpasswordhash() only when the supplied username exists. A nonexistent username returns immediately, while a valid username causes an expensive bcrypt calculation. An unauthenticated remote attacker can compare authentication response times to enumerate valid Wazuh usernames and use that information in subsequent credential attacks. This issue is fixed in versions 4.14.6 and 5.0.0-beta2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wazuhto a version that resolves this vulnerability.Fixed in 4.14.6 - Upgrade
Upgrade
wazuhto a version that resolves this vulnerability.Fixed in 5.0.0-beta2
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated remote attacker can exploit the timing difference in authentication responses. No credentials or user interaction are required.
Which Wazuh versions are affected?
The issue affects Wazuh versions from 4.0.0 through versions before 4.14.6, as well as versions before 5.0.0-beta2. It is fixed in 4.14.6 and 5.0.0-beta2.
What can an attacker learn or do with the timing difference?
An attacker can distinguish valid usernames from nonexistent ones by comparing authentication response times. The disclosed usernames can then support subsequent credential attacks.