Unknown · Cockpit Cms · CVE-2026-82449
**Name of the Vulnerable Software and Affected Versions**
Cockpit CMS versions prior to 2.14.1
**Description**
An account enumeration issue exists in the auth check endpoint. This occurs because of timing discrepancies during password verification; existing accounts trigger bcrypt verification, which takes longer, while non-existent accounts return a response immediately. Attackers can measure these response times across multiple requests to identify valid accounts.
**Recommendations**
Update Cockpit CMS to version 2.14.1 or later.