CVE-2026-53525: WeeChat has Non-Constant-Time Password Hash Comparison in Relay Authentication
WeeChat (Wee Enhanced Environment for Chat) is a free chat client. In versions 0.3.1 through 4.9.0, the WeeChat relay authentication uses non-constant-time string comparison functions (weechatstrcasecmp and strcmp) to verify password hashes and plaintext passwords. An attacker can exploit timing differences to extract the server-computed hash character by character, then authenticate using the correct hash without knowing the password. Version 4.9.1 fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
weechatto a version that resolves this vulnerability.Fixed in 4.9.1
Event History
Frequently Asked Questions
Who is exposed to this issue?
Instances running WeeChat versions 0.3.1 through 4.9.0 with relay authentication reachable by an attacker are exposed. The attack can be performed remotely and does not require prior authentication or user interaction.
What does an attacker need to exploit it?
The attacker needs the ability to repeatedly attempt relay authentication and measure timing differences in password-hash or plaintext-password comparisons. The high attack complexity indicates that extracting the hash character by character requires sufficiently reliable timing measurements.
What is the impact if exploitation succeeds?
An attacker can recover the server-computed hash through timing differences and authenticate with that hash without knowing the underlying password. This can result in integrity and availability impact.
How can I remediate the issue?
Upgrade WeeChat to version 4.9.1, which fixes the non-constant-time relay authentication comparisons.