CVE-2026-109379
5.3 MEDIUMpublic exploit availablePublished 2026-10-12 · Updated 2026-10-16
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
Cockpit CMS 2.14.1 contains an observable timing discrepancy vulnerability that allows unauthenticated attackers to enumerate accounts due to an incomplete timing fix in /auth/check. Attackers can post login attempts and measure response times, since existing accounts incur two bcrypt operations versus one, revealing valid usernames and email addresses.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-208
Public exploit & PoC references
- https://github.com/Cockpit-HQ/Cockpit
- https://github.com/Cockpit-HQ/Cockpit/blob/2.14.1/modules/App/Controller/Auth.php
- https://github.com/Cockpit-HQ/Cockpit/blob/2.14.1/modules/App/Helper/Auth.php
- https://github.com/Cockpit-HQ/Cockpit/commit/5d65ae7b63a261a63e8809e5fba857ef3eadb2ac
- https://github.com/Cockpit-HQ/Cockpit/issues/328
All references
- https://github.com/Cockpit-HQ/Cockpit
- https://github.com/Cockpit-HQ/Cockpit/blob/2.14.1/modules/App/Controller/Auth.php
- https://github.com/Cockpit-HQ/Cockpit/blob/2.14.1/modules/App/Helper/Auth.php
- https://github.com/Cockpit-HQ/Cockpit/commit/5d65ae7b63a261a63e8809e5fba857ef3eadb2ac
- https://github.com/Cockpit-HQ/Cockpit/issues/328
- https://www.vulncheck.com/advisories/cockpit-cms-2.14.1-account-enumeration-via-timing-discrepancy-in-auth-check
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- LOWCVE-2026-107269PoC
- UNSCOREDCVE-2026-18036PoC
- UNSCOREDCVE-2026-18040PoC
- UNSCOREDCVE-2026-24715
- MEDIUMCVE-2026-49265PoC
- LOWCVE-2026-54872PoC
- LOWCVE-2026-54875PoC
- MEDIUMCVE-2026-58272PoC
Related by shared AI tags and CWE weakness class. Browse the full archive.