CVE-2026-82449— Cockpit CMS before 2.14.1 Account Enumeration via Auth Timing
Quick assessment
Affected
cockpit-hq cockpit
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Cockpit CMS 在 2.14.1 版本之前存在一个账户枚举漏洞，位于身份验证检查端点，其原因是密码验证过程中存在时序差异。攻击者可以通过对多个请求测量响应时间来确定哪些账户存在，因为已存在的账户会触发 bcrypt 验证（耗时较长），而不存在的账户则立即返回（耗时极短）。
Possible ATT&CK Techniques 1 AI
T1589 · Gather Victim Identity Information
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-82449
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Cockpit CMS before 2.14.1 Account Enumeration via Auth Timing
Source: CVE Program / CVE List V5
Vulnerability Description
Cockpit CMS before 2.14.1 contains an account enumeration vulnerability in the auth check endpoint due to timing discrepancies in password verification. Attackers can measure response times across multiple requests to determine which accounts exist by observing that existing accounts trigger bcrypt verification while non-existent accounts return immediately.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过时间差异性导致的信息暴露
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| cockpit-hq | cockpit | 0 ~ 2.14.1 | - |
|
II. Public POCs for CVE-2026-82449
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-82449
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-82449 (1)
Vendor Advisories for CVE-2026-82449 (1)
Other References for CVE-2026-82449 (3)
-
-
🔗 https://link.mateocallec.com/MFC-2026-001 third-party-advisory
-
IV. Related Vulnerabilities
Same product: cockpit
-
CVE-2026-58467
Cockpit CMS 2.14.0 - Path Traversal Local File Inclusion via -
CVE-2026-23695
Cockpit CMS 2.14.0 Stored XSS via Set Field Display Template -
CVE-2026-6626
Cockpit-HQ Cockpit Asset Handler/Aggregate data query logic -
CVE-2026-31891
Cockpit CMS has SQL Injection in MongoLite Aggregation Optim -
CVE-2025-7053
Cockpit save cross site scripting
Same vendor: cockpit-hq
-
CVE-2026-58467
Cockpit CMS 2.14.0 - Path Traversal Local File Inclusion via -
CVE-2026-23695
Cockpit CMS 2.14.0 Stored XSS via Set Field Display Template -
CVE-2026-6626
Cockpit-HQ Cockpit Asset Handler/Aggregate data query logic -
CVE-2026-31891
Cockpit CMS has SQL Injection in MongoLite Aggregation Optim -
CVE-2023-4451
Cross-site Scripting (XSS) - Reflected in cockpit-hq/cockpit
Same weakness: CWE-208
-
CVE-2026-55785
free5GC AUSF uses non-constant-time authentication compariso -
CVE-2026-78500
Dimension Blind SSRF via Database Test Connection Feature -
CVE-2026-80199
Kimai before 2.54.0 Username Enumeration via Timing Oracle -
CVE-2026-18259
Token Content Access - Moderately critical - Access bypass - -
CVE-2026-72701
Grav CMS before 2.0.16 Timing Attack via verifyNonce
V. Comments for CVE-2026-82449
No comments yet