Description

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta2, AuthenticationManager.check_user() in framework/wazuh/rbac/orm.py performs check_password_hash() only when the supplied username exists. A nonexistent username returns immediately, while a valid username causes an expensive bcrypt calculation. An unauthenticated remote attacker can compare authentication response times to enumerate valid Wazuh usernames and use that information in subsequent credential attacks. This issue is fixed in versions 4.14.6 and 5.0.0-beta2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-19T17:18:48.770Z",
  "pubdate": "2026-08-19T17:18:48.770Z",
  "executiveSummary": "An unauthenticated remote username enumeration vulnerability exists in the Wazuh threat prevention, detection, and response platform. The flaw resides within the authentication mechanism managed by the framework/wazuh/rbac/orm.py script, specifically inside the AuthenticationManager.check_user() function.\nThe vulnerability allows remote attackers to determine valid user accounts within the system by measuring response time discrepancies caused by conditional execution paths. When a non-existent username is submitted, the application returns an error response immediately without performing computationally intensive cryptographic operations. Conversely, when a valid username is provided, the application invokes a resource-intensive bcrypt password hashing calculation, introducing a measurable time delay.\nThe impact of this security deficiency involves reconnaissance capabilities where threat actors can systematically harvest valid usernames. This leaked intelligence significantly enhances the success rate of subsequent credential-based attacks, such as brute-force or dictionary attacks against the Wazuh platform.\nAffected products include Wazuh versions from 4.0.0 up to, but not including, 4.14.6, as well as version 5.0.0-beta2. Exploitation requires network access to the authentication interface but does not require prior authentication or elevated privileges.",
  "technicalDetails": "The root cause of the vulnerability is a timing side-channel resulting from conditional control flow tied to user existence verification. Within framework/wazuh/rbac/orm.py, the AuthenticationManager.check_user() function fails to execute constant-time validation checks for authentication requests.\nThe vulnerable component is the role-based access control (RBAC) Object-Relational Mapping (ORM) authentication module of the Wazuh framework. Affected software versions include 4.0.0 through 4.14.6 and 5.0.0-beta2.\nThe attack flow proceeds as follows: An unauthenticated remote attacker sends an HTTP request containing a target username and an arbitrary or dummy password to the Wazuh authentication endpoint. The server queries the database via the ORM layer to check if the supplied username exists. If the username does not exist in the database, the check_user() method halts execution immediately and returns an invalid credentials response, resulting in a low latency response time. If the username does exist, the execution flow proceeds to invoke the check_password_hash() function, which executes an expensive bcrypt password hashing algorithm to verify the supplied password against the stored hash. This cryptographic computation introduces a noticeable processing delay before the server returns an authentication failure response.\nBy collecting and statistically analyzing round-trip response times or server-side processing durations across multiple requests, an attacker can reliably differentiate between fast responses (non-existent users) and slow responses (valid users). This timing differential enables automated enumeration of valid system accounts without generating high-volume authentication failure logs that might trigger alerting mechanisms.\nAuthentication and privilege requirements are minimal; the attacker operates completely unauthenticated and requires no prior privileges beyond network reachability to the Wazuh authentication service. Network exposure is present wherever the Wazuh authentication interface is accessible to untrusted networks.\nPost-exploitation impact is preparatory in nature. The enumerated valid usernames provide a curated target list for subsequent targeted brute-force attacks, credential stuffing, or password spray campaigns against the Wazuh platform."
}