CVE-2026-109379

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-109379", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-10-12T14:23:25.691Z", "datePublished": "2026-10-12T20:55:11.101Z", "dateUpdated": "2026-10-13T16:52:23.847Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-12T20:55:11.101Z"}, "datePublic": "2026-10-08T00:00:00.000Z", "title": "Cockpit CMS 2.14.1 Account Enumeration via Timing Discrepancy in /auth/check", "descriptions": [{"lang": "en", "value": "Cockpit CMS 2.14.1 contains an observable timing discrepancy vulnerability that allows unauthenticated attackers to enumerate accounts due to an incomplete timing fix in /auth/check. Attackers can post login attempts and measure response times, since existing accounts incur two bcrypt operations versus one, revealing valid usernames and email addresses."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Observable Timing Discrepancy", "cweId": "CWE-208", "type": "CWE"}]}], "affected": [{"vendor": "cockpit-hq", "product": "cockpit", "defaultStatus": "unaffected", "versions": [{"version": "2.14.1", "status": "affected", "versionType": "semver", "lessThanOrEqual": "2.14.1"}], "packageURL": "pkg:composer/cockpit-hq/cockpit", "repo": "https://github.com/Cockpit-HQ/Cockpit"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 6.9, "baseSeverity": "MEDIUM"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}], "references": [{"url": "https://github.com/Cockpit-HQ/Cockpit/issues/328", "tags": ["issue-tracking"], "name": "GitHub Issue #328"}, {"url": "https://github.com/Cockpit-HQ/Cockpit/blob/2.14.1/modules/App/Controller/Auth.php", "tags": ["technical-description"], "name": "Vulnerable code in Controller/Auth.php"}, {"url": "https://github.com/Cockpit-HQ/Cockpit/blob/2.14.1/modules/App/Helper/Auth.php", "tags": ["technical-description"], "name": "Vulnerable code in Helper/Auth.php"}, {"url": "https://github.com/Cockpit-HQ/Cockpit/commit/5d65ae7b63a261a63e8809e5fba857ef3eadb2ac", "tags": ["related", "patch"], "name": "Incomplete fix for CVE-2026-82449"}, {"url": "https://github.com/Cockpit-HQ/Cockpit", "tags": ["product"]}, {"name": "VulnCheck Advisory: Cockpit CMS 2.14.1 Account Enumeration via Timing Discrepancy in /auth/check", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/cockpit-cms-2.14.1-account-enumeration-via-timing-discrepancy-in-auth-check"}], "credits": [{"lang": "en", "value": "Nicolas Deleville", "type": "finder"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-13T16:22:05.555173Z", "id": "CVE-2026-109379", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-13T16:52:23.847Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "Cockpit CMS 2.14.1 Account Enumeration via Timing Discrepancy in /auth/check", "credits": [{"lang": "en", "type": "finder", "value": "Nicolas Deleville"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 6.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW"}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"repo": "https://github.com/Cockpit-HQ/Cockpit", "vendor": "cockpit-hq", "product": "cockpit", "versions": [{"status": "affected", "version": "2.14.1", "versionType": "semver", "lessThanOrEqual": "2.14.1"}], "packageURL": "pkg:composer/cockpit-hq/cockpit", "defaultStatus": "unaffected"}], "datePublic": "2026-10-08T00:00:00.000Z", "references": [{"url": "https://github.com/Cockpit-HQ/Cockpit/issues/328", "name": "GitHub Issue #328", "tags": ["issue-tracking"]}, {"url": "https://github.com/Cockpit-HQ/Cockpit/blob/2.14.1/modules/App/Controller/Auth.php", "name": "Vulnerable code in Controller/Auth.php", "tags": ["technical-description"]}, {"url": "https://github.com/Cockpit-HQ/Cockpit/blob/2.14.1/modules/App/Helper/Auth.php", "name": "Vulnerable code in Helper/Auth.php", "tags": ["technical-description"]}, {"url": "https://github.com/Cockpit-HQ/Cockpit/commit/5d65ae7b63a261a63e8809e5fba857ef3eadb2ac", "name": "Incomplete fix for CVE-2026-82449", "tags": ["related", "patch"]}, {"url": "https://github.com/Cockpit-HQ/Cockpit", "tags": ["product"]}, {"url": "https://www.vulncheck.com/advisories/cockpit-cms-2.14.1-account-enumeration-via-timing-discrepancy-in-auth-check", "name": "VulnCheck Advisory: Cockpit CMS 2.14.1 Account Enumeration via Timing Discrepancy in /auth/check", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "Cockpit CMS 2.14.1 contains an observable timing discrepancy vulnerability that allows unauthenticated attackers to enumerate accounts due to an incomplete timing fix in /auth/check. Attackers can post login attempts and measure response times, since existing accounts incur two bcrypt operations versus one, revealing valid usernames and email addresses."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-208", "description": "Observable Timing Discrepancy"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-12T20:55:11.101Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-109379", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-13T16:22:05.555173Z"}}}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-10-13T16:22:06.188Z"}}]}, "cveMetadata": {"cveId": "CVE-2026-109379", "state": "PUBLISHED", "dateUpdated": "2026-10-12T20:55:11.101Z", "dateReserved": "2026-10-12T14:23:25.691Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-10-12T20:55:11.101Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:composer/cockpit-hq/cockpit", "product": "cockpit", "repo": "https://github.com/Cockpit-HQ/Cockpit", "vendor": "cockpit-hq", "versions": [{"lessThanOrEqual": "2.14.1", "status": "affected", "version": "2.14.1", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Cockpit CMS 2.14.1 contains an observable timing discrepancy vulnerability that allows unauthenticated attackers to enumerate accounts due to an incomplete timing fix in /auth/check. Attackers can post login attempts and measure response times, since existing accounts incur two bcrypt operations versus one, revealing valid usernames and email addresses."}], "id": "CVE-2026-109379", "lastModified": "2026-10-16T18:25:45.343", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-109379", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-13T16:22:05.555173Z", "version": "2.0.3"}}]}, "published": "2026-10-12T21:17:11.000", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/Cockpit-HQ/Cockpit"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/Cockpit-HQ/Cockpit/blob/2.14.1/modules/App/Controller/Auth.php"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/Cockpit-HQ/Cockpit/blob/2.14.1/modules/App/Helper/Auth.php"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/Cockpit-HQ/Cockpit/commit/5d65ae7b63a261a63e8809e5fba857ef3eadb2ac"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/Cockpit-HQ/Cockpit/issues/328"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/cockpit-cms-2.14.1-account-enumeration-via-timing-discrepancy-in-auth-check"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-208"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{"bugzilla": {"description": "cockpit: Cockpit: User enumeration via timing discrepancy", "id": "2549976", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2549976"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "status": "draft"}, "cwe": "CWE-208", "details": ["A flaw was found in Cockpit. An observable timing discrepancy in the authentication mechanism allows an unauthenticated remote attacker to enumerate valid user accounts. By submitting login requests and measuring response times, an attacker can identify whether a username or email address exists based on differences in processing duration."], "name": "CVE-2026-109379", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "cockpit", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "cockpit", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "cockpit", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "cockpit", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-10-12T20:55:11Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-109379\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-109379\nhttps://github.com/Cockpit-HQ/Cockpit\nhttps://github.com/Cockpit-HQ/Cockpit/blob/2.14.1/modules/App/Controller/Auth.php\nhttps://github.com/Cockpit-HQ/Cockpit/blob/2.14.1/modules/App/Helper/Auth.php\nhttps://github.com/Cockpit-HQ/Cockpit/commit/5d65ae7b63a261a63e8809e5fba857ef3eadb2ac\nhttps://github.com/Cockpit-HQ/Cockpit/issues/328\nhttps://www.vulncheck.com/advisories/cockpit-cms-2.14.1-account-enumeration-via-timing-discrepancy-in-auth-check"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.14.1,2.14.1]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "cockpit", "source": "cna", "vendor": "cockpit-hq"}, "product": "cockpit", "vendor": "cockpit-hq"}], "created": "2026-10-12T23:00:10.068872+00:00", "updated": "2026-10-12T23:15:15.030340+00:00", "vendors": ["cockpit-hq", "cockpit-hq$PRODUCT$cockpit"]}