Description

Cockpit CMS before 2.14.1 contains an account enumeration vulnerability in the auth check endpoint due to timing discrepancies in password verification. Attackers can measure response times across multiple requests to determine which accounts exist by observing that existing accounts trigger bcrypt verification while non-existent accounts return immediately.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-29T13:16:39.030Z",
  "pubdate": "2026-08-29T13:16:39.030Z",
  "executiveSummary": "Cockpit CMS versions prior to 2.14.1 are susceptible to an account enumeration vulnerability located within the authentication verification mechanism.\nThe vulnerability arises from measurable timing discrepancies during the password verification process, allowing unauthenticated remote attackers to confirm the existence of valid user accounts.\nBy observing variances in response latency, an attacker can distinguish between legitimate usernames—which trigger the resource-intensive bcrypt hashing function—and non-existent identifiers that result in an immediate response.\nThis flaw facilitates intelligence gathering, as attackers can build a target list of valid system usernames for subsequent brute-force or credential-stuffing attacks.\nThe vulnerability does not require prior authentication and is exploitable over the network by analyzing server response times, posing a significant risk to user privacy and system hardening efforts.",
  "technicalDetails": "The vulnerability is rooted in the implementation of the authentication endpoint within Cockpit CMS, specifically how the system handles the verification logic for user credentials.\nWhen a login request is initiated, the application performs a lookup for the provided username. If the user does not exist, the authentication service typically returns an immediate failure. However, if the user account is found, the system proceeds to verify the provided password against the stored hash using the bcrypt algorithm.\nBcrypt is intentionally designed to be computationally expensive to mitigate brute-force attempts; however, in this implementation, the disparity in processing time between the 'user not found' exit path and the 'password verification' path creates a measurable side-channel.\nAn attacker can exploit this by sending a series of crafted HTTP requests to the authentication endpoint, systematically iterating through a list of potential usernames. By employing statistical analysis to filter out network jitter and baseline latency, the attacker measures the time-to-first-byte (TTFB) or total round-trip time for each request.\nA request for a non-existent account returns in a consistently lower time frame because the bcrypt hashing process is never invoked. Conversely, a request for a valid username results in a latency spike commensurate with the configured cost factor of the bcrypt algorithm.\nThis side-channel attack is highly effective for large-scale enumeration. Since the endpoint does not implement uniform response delays or constant-time comparison logic, the authentication process acts as an oracle for account existence. The attack flow involves capturing timing data across multiple packets, normalizing the results to account for network variances, and identifying clear binary outcomes based on the observed latency threshold.\nThis vulnerability is classified as an information disclosure issue, as it bypasses standard security-through-obscurity regarding user identity. The impact is significant because it lowers the barrier to entry for credential-based attacks, allowing an adversary to focus their resources on known-valid accounts, thereby increasing the probability of successful unauthorized access."
}