CVE-2026-109379 Details

A vulnerability in Cockpit CMS version 2.14.1 allows unauthenticated attackers to enumerate accounts through an observable timing discrepancy in the authentication process. The vulnerability arises because existing accounts require two bcrypt operations for password verification, while non-existent accounts only incur one, creating a measurable difference in response times. This timing discrepancy can be exploited to identify valid usernames and email addresses.

Users are advised to update to Cockpit CMS version 2.14.2 or later, where this vulnerability has been addressed.