CVE-2026-109379 — Cockpit CMS 2.14.1 Account Enumeration via Timing Discrepancy in /auth/check
Cockpit CMS 2.14.1 contains an observable timing discrepancy vulnerability that allows unauthenticated attackers to enumerate accounts due to an incomplete timing fix in /auth/c…
Published: 2026-10-12 · CVSS: 6.9 · CVSS 4.0
Cockpit CMS 2.14.1 contains an observable timing discrepancy vulnerability that allows unauthenticated attackers to enumerate accounts due to an incomplete timing fix in /auth/check. Attackers can post login attempts and measure response times, since existing accounts incur two bcrypt operations versus one, revealing valid usernames and email addresses.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7