CVE-2026-44255: Wazuh: Username Enumeration via Timing Side-Channel

Vulnerability summary

CVE-2026-44255 is a medium (CVSS 5.3) Observable Timing Discrepancy vulnerability in wazuh. EPSS estimates a 0.62% chance of exploitation in the next 30 days, higher than 48.8% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 19-08-2026
   PublishedVulnerability first disclosed.
2. 25-08-2026
   Last modifiedVulnerability information updated.

Description

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta2, AuthenticationManager.check_user() in framework/wazuh/rbac/orm.py performs check_password_hash() only when the supplied username exists. A nonexistent username returns immediately, while a valid username causes an expensive bcrypt calculation. An unauthenticated remote attacker can compare authentication response times to enumerate valid Wazuh usernames and use that information in subsequent credential attacks. This issue is fixed in versions 4.14.6 and 5.0.0-beta2.

• CWE-208Observable Timing DiscrepancyTwo separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not.