Vulnerability · Published Oct 12, 2026 · Assigned by VulnCheck
CVE-2026-109379Cockpit CMS 2.14.1 Account Enumeration via Timing Discrepancy in /auth/check
Medium 5.3
In plain English
A medium-severity security flaw in cockpit from cockpit-hq. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 29% of all known vulnerabilities).
Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.3%top 71.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Cockpit CMS 2.14.1 contains an observable timing discrepancy vulnerability that allows unauthenticated attackers to enumerate accounts due to an incomplete timing fix in /auth/check. Attackers can post login attempts and measure response times, since existing accounts incur two bcrypt operations versus one, revealing valid usernames and email addresses.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| cockpit-hq | cockpit | 2.14.1 – through 2.14.1 |
Weakness: CWE-208 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
References
- GitHub Issue #328 issue-tracking
- Vulnerable code in Controller/Auth.php technical-description
- Vulnerable code in Helper/Auth.php technical-description
- Incomplete fix for CVE-2026-82449 related, patch
- https://github.com/Cockpit-HQ/Cockpit product
- VulnCheck Advisory: Cockpit CMS 2.14.1 Account Enumeration via Timing Discrepancy in /auth/check third-party-advisory