Race Condition in Wazuh API Throttling Vulnerability

CVE-2026-93346

What is CVE-2026-93346?

Wazuh, specifically versions from 4.0.0 to 4.14.7, is susceptible to a race condition in its API login throttling mechanism. This flaw allows unauthenticated attackers to effectively circumvent the max login attempts restriction. By issuing a series of concurrent requests to the authenticate and run_as endpoints, attackers can bypass the block check, leading to unlimited attempts at password guessing. This poses a significant risk as it allows unauthorized access and could lead to further exploitation of the system.

References