CVE-2026-82449: Cockpit CMS before 2.14.1 Account Enumeration via Auth Timing

Q: Which deployments are exposed to this issue?

Cockpit CMS versions before 2.14.1 are affected if their authentication check endpoint is reachable by an attacker. The issue can be exploited remotely without authentication or user interaction.

Q: What does an attacker need to do to enumerate accounts?

An attacker can submit repeated authentication checks and compare response times. Requests for existing accounts take longer because they invoke bcrypt password verification, while nonexistent accounts return immediately.

Q: What is the practical impact of successful exploitation?

The vulnerability reveals whether account names exist. It does not itself provide password disclosure, authentication bypass, data modification, or denial of service.

Published Aug 29, 2026

Updated

Cockpit CMS before 2.14.1 contains an account enumeration vulnerability in the auth check endpoint due to timing discrepancies in password verification. Attackers can measure response times across multiple requests to determine which accounts exist by observing that existing accounts trigger bcrypt verification while non-existent accounts return immediately.

Affected Software

1 affected component

Cockpit CMS Cockpit CMS<2.14.1

Event History

Aug 29, 2026

CVE Published

via MITRE·12:05 PM

Data Sourced

via MITRE·12:05 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Cockpit CMS versions before 2.14.1 are affected if their authentication check endpoint is reachable by an attacker. The issue can be exploited remotely without authentication or user interaction.

What does an attacker need to do to enumerate accounts?

An attacker can submit repeated authentication checks and compare response times. Requests for existing accounts take longer because they invoke bcrypt password verification, while nonexistent accounts return immediately.

What is the practical impact of successful exploitation?

The vulnerability reveals whether account names exist. It does not itself provide password disclosure, authentication bypass, data modification, or denial of service.

CVE-2026-82449: Cockpit CMS before 2.14.1 Account Enumeration via Auth Timing

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to do to enumerate accounts?

What is the practical impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to do to enumerate accounts?

What is the practical impact of successful exploitation?