CVE-2026-44255 in Wazuh
Summary
by MITRE • 08/19/2026
Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta2, AuthenticationManager.check_user() in framework/wazuh/rbac/orm.py performs check_password_hash() only when the supplied username exists. A nonexistent username returns immediately, while a valid username causes an expensive bcrypt calculation. An unauthenticated remote attacker can compare authentication response times to enumerate valid Wazuh usernames and use that information in subsequent credential attacks. This issue is fixed in versions 4.14.6 and 5.0.0-beta2.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/20/2026
The vulnerability identified within the Wazuh platform, specifically affecting versions from 4.0.0 through 4.14.6 and version 5.0.0-beta2, represents a classic timing side-channel attack vector rooted in improper authentication logic implementation. The core technical flaw resides in the AuthenticationManager.check_user() function located within the framework/wazuh/rbac/orm.py module. This component is responsible for validating user credentials against stored hashes during the login process. In its vulnerable state, the code exhibits a distinct behavioral asymmetry based on whether the provided username exists in the system database. When an attacker supplies a username that does not correspond to any existing account, the function returns immediately without performing computationally intensive operations. Conversely, when a valid username is supplied, the application proceeds to execute check_password_hash(), which typically involves expensive cryptographic calculations such as bcrypt hashing to verify the password. This discrepancy creates a measurable difference in response time between requests for non-existent and existing usernames.
This timing disparity allows an unauthenticated remote attacker to perform user enumeration by analyzing the latency of authentication responses. By sending multiple login attempts with varying usernames and measuring the time taken for each server response, the attacker can statistically distinguish valid accounts from invalid ones. Valid users will consistently exhibit higher response times due to the execution of the password hashing algorithm, while non-existent users result in near-instantaneous rejection. This capability effectively bypasses traditional account lockout mechanisms that rely on failed attempt counts rather than timing analysis. The ability to accurately enumerate valid usernames significantly lowers the barrier for subsequent credential-based attacks, such as brute force or dictionary attacks, by allowing the attacker to focus resources exclusively on active accounts and ignore invalid targets.
From a security classification perspective, this vulnerability aligns with CWE-208, which describes an observable timing discrepancy that can be exploited to gain unauthorized access or information. It also maps closely to CWE-613, insufficient session expiration, in the context of authentication enumeration, though more accurately it falls under CWE-209 due to the generation of timing side channels. In terms of adversary tactics, this technique corresponds to ATT&CK T1589.001, specifically Credential Enum: Password Guessing, where attackers use automated tools to determine valid usernames before launching targeted password attacks. The exploitation does not require prior authentication or complex payload delivery mechanisms, making it a low-effort, high-impact vulnerability that compromises the confidentiality of user identity information within the Wazuh management console.
The operational impact of this flaw extends beyond simple username enumeration. By confirming which accounts are active, attackers can tailor their attack strategies to target privileged users with higher-value credentials or known weak passwords. This increases the likelihood of successful compromise and subsequent lateral movement within the managed infrastructure. Since Wazuh is often deployed as a central security monitoring platform, gaining access through enumerated valid credentials could allow an attacker to disable alerts, tamper with logs, or exfiltrate sensitive data collected by the agent network. The vulnerability underscores the critical importance of implementing constant-time comparison algorithms and ensuring that authentication logic performs equivalent computational work regardless of whether the username exists in the database.
Mitigation for this issue involves upgrading Wazuh to version 4.14.6 or later, which includes a fix for the AuthenticationManager.check_user() function. The patched implementation ensures that the application behaves consistently by performing the expensive password hash calculation even when the username does not exist, thereby eliminating the timing difference exploitable by attackers. In environments where immediate upgrading is not feasible, administrators should implement network-level rate limiting on authentication endpoints to slow down automated enumeration attempts. Additionally, deploying a Web Application Firewall with rules designed to detect and block rapid-fire login requests from single IP addresses can provide an additional layer of defense against brute force and timing-based attacks. Regular security audits focusing on authentication logic consistency are recommended to prevent similar side-channel vulnerabilities in other components of the platform.