Timing Discrepancy Vulnerability in Cockpit CMS by Cockpit HQ

CVE-2026-109379

What is CVE-2026-109379?

Cockpit CMS version 2.14.1 contains a timing discrepancy vulnerability that can enable unauthenticated attackers to enumerate user accounts. This occurs due to an incomplete timing fix in the authentication process located in the /auth/check endpoint. Attackers can exploit this by submitting login attempts and analyzing the response times — existing accounts trigger two bcrypt operations, while non-existent accounts trigger only one. This differential in response timing can inadvertently reveal valid usernames and email addresses, posing a significant risk to user privacy.

References