Cockpit CMS before 2.14.1 Account Enumeration via Auth Timing
Cockpit CMS before 2.14.1 contains an account enumeration vulnerability in the auth check endpoint due to timing discrepancies in password verification. Attackers can measure response times across multiple requests to determine which accounts exist by observing that existing accounts trigger bcrypt verification while non-existent accounts return immediately.
CVE-2026-82449
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-82449
cockpit
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "cockpit-hq",
"product": "cockpit",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "2.14.1",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.14.1",
"versionType": "semver"
}
],
"packageURL": "pkg:composer/cockpit-hq/cockpit",
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-82449
Source reference:
/cveMetadata/cveId
Publisher severity
medium
Source reference: /containers/cna/metrics
- Event
- #1541 · Revision 1
- Added to Heist Feed
- Publisher date