PT-2026-35965

CVE-2026-26206

Published

2026-03-17

Updated

2026-04-29

Description by

CVSS 3.1

6.5

Medium

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Wazuh versions 4.0.0 through 4.14.3

Description Wazuh server API brute-force protection for the 'POST /security/user/authenticate' endpoint can be bypassed by sending concurrent authentication requests. While the max login attempts threshold is correctly enforced for sequential requests, a parallel burst allows more failed login attempts to be processed before an IP block is applied, enabling more password guesses than the configured policy intends.

Recommendations Update to version 4.14.4.

Exploitability

Exploit

Fix

Impacts

Researchers

Alimezar

Vendors

Affected products

Weakness enumeration

CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization (\'Race Condition\')

CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition