Timing Attack Vulnerability in WeeChat Client by Weechat Developers
CVE-2026-53525

7.4HIGH

Key Information:

Vendor

Weechat

Status
Weechat
Vendor
CVE Published:
21 August 2026

What is CVE-2026-53525?

The WeeChat client, a widely-used open-source chat application, is susceptible to a timing attack due to its non-constant-time string comparison during relay authentication. Versions ranging from 0.3.1 to 4.9.0 utilize functions such as weechat_strcasecmp and strcmp, which can inadvertently reveal password hashes through variances in response times. This flaw allows malicious actors to discern hash characters sequentially, potentially enabling them to authenticate without knowing the original password. The issue has been rectified in version 4.9.1.

Affected Version(s)

weechat >= 0.3.4, < 4.9.1

References

https://github.com/weechat/weechat/security/advisories/GH...
x_refsource_CONFIRM

CVSS V3.1

Score:
7.4
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.