Remote Authentication Vulnerability in Wazuh Affects User Enumeration
CVE-2026-44255
What is CVE-2026-44255?
Wazuh, an open-source platform for threat prevention and detection, has a vulnerability in the AuthenticationManager.check_user() function that allows an unauthenticated remote attacker to conduct user enumeration. The issue arises from a time-based attack where valid usernames can be identified due to varied authentication response times. When a nonexistent username is entered, the check returns immediately, while a valid username triggers an expensive bcrypt hash computation. Attackers can exploit this discrepancy to identify valid usernames for subsequent credential attacks. The vulnerability has been addressed in Wazuh versions 4.14.6 and 5.0.0-beta2.
Affected Version(s)
wazuh >= 4.0.0, < 4.14.6 < 4.0.0, 4.14.6
wazuh >= 5.0.0-beta1, < 5.0.0-beta2 < 5.0.0-beta1, 5.0.0-beta2