{"id":"CVE-2026-109379","summary":"Cockpit CMS 2.14.1 Account Enumeration via Timing Discrepancy in /auth/check","details":"Cockpit CMS 2.14.1 contains an observable timing discrepancy vulnerability that allows unauthenticated attackers to enumerate accounts due to an incomplete timing fix in /auth/check. Attackers can post login attempts and measure response times, since existing accounts incur two bcrypt operations versus one, revealing valid usernames and email addresses.","modified":"2026-10-13T10:48:12.219026658Z","published":"2026-10-12T20:55:11.101Z","database_specific":{"cna_assigner":"VulnCheck","cwe_ids":["CWE-208"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/109xxx/CVE-2026-109379.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/109xxx/CVE-2026-109379.json"},{"type":"PACKAGE","url":"https://github.com/Cockpit-HQ/Cockpit"},{"type":"ARTICLE","url":"https://github.com/Cockpit-HQ/Cockpit/blob/2.14.1/modules/App/Controller/Auth.php"},{"type":"ARTICLE","url":"https://github.com/Cockpit-HQ/Cockpit/blob/2.14.1/modules/App/Helper/Auth.php"},{"type":"FIX","url":"https://github.com/Cockpit-HQ/Cockpit/commit/5d65ae7b63a261a63e8809e5fba857ef3eadb2ac"},{"type":"REPORT","url":"https://github.com/Cockpit-HQ/Cockpit/issues/328"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109379"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/cockpit-cms-2.14.1-account-enumeration-via-timing-discrepancy-in-auth-check"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/cockpit-hq/cockpit","events":[{"introduced":"489c3330274c553cb8fb166297d640bd470b5d3a"},{"last_affected":"489c3330274c553cb8fb166297d640bd470b5d3a"}],"database_specific":{"extracted_events":[{"introduced":"2.14.1"},{"last_affected":"2.14.1"}],"source":"AFFECTED_FIELD"}}],"versions":["2.14.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-109379.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"}]}