CVE-2026-44255

Name of the Vulnerable Software and Affected Versions Wazuh versions 4.0.0 through 4.14.5 Wazuh versions 5.0.0-beta1 and earlier

Description The check user() function within AuthenticationManager in framework/wazuh/rbac/orm.py only executes check password hash() if the provided username exists. Because a nonexistent username triggers an immediate return while a valid username initiates a computationally expensive bcrypt calculation, an unauthenticated remote attacker can use timing analysis of authentication responses to enumerate valid usernames. This information can then be leveraged for subsequent credential attacks.

Recommendations Update to version 4.14.6. Update to version 5.0.0-beta2.