CVE-2026-93346: Wazuh 4.0.0 before 4.14.8 API Brute-Force Protection Bypass via Race Condition
Wazuh from 4.0.0 before 4.14.8 contains a race condition in API login throttling that allows unauthenticated attackers to bypass maxloginattempts by sending concurrent requests. Attackers can fire concurrent login bursts to the authenticate and runas endpoints, each passing the block check before failures are counted, enabling unlimited password guessing.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Wazuhto a version that resolves this vulnerability.Fixed in 4.14.8
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated attacker able to reach the Wazuh API can attempt exploitation. No credentials or user interaction are required.
What does an attacker need to do to bypass the login limit?
The attacker must send concurrent bursts of login requests to the authenticate or run_as endpoints. The requests exploit a timing window in which each request passes the block check before failed attempts are recorded.
Are deployments with API login throttling affected?
Yes. The affected login-throttling logic can be bypassed despite the configured max_login_attempts limit, allowing unlimited password-guessing attempts through concurrent requests.
Which versions need remediation?
Wazuh versions from 4.0.0 before 4.14.8 are affected. Updating to 4.14.8 or later removes the affected version range.