CVE-2026-109379: Cockpit CMS Timing Attack Vulnerability

CVE-2026-109379 Overview

CVE-2026-109379 is an observable timing discrepancy vulnerability [CWE-208] in Cockpit CMS 2.14.1. The flaw resides in the /auth/check endpoint and allows unauthenticated attackers to enumerate valid accounts by measuring server response times. Existing accounts trigger two bcrypt operations while nonexistent accounts trigger only one, producing a measurable timing delta. Attackers can submit login attempts and compare response latencies to confirm valid usernames or email addresses. The issue stems from an incomplete fix to an earlier timing-attack mitigation in the authentication flow.

Critical Impact
Unauthenticated remote attackers can enumerate valid Cockpit CMS accounts by timing responses to /auth/check requests, enabling targeted credential attacks against identified users.

Affected Products

Cockpit CMS 2.14.1
modules/App/Controller/Auth.php (login handler)
modules/App/Helper/Auth.php (authentication helper)

Discovery Timeline

2026-10-12 - CVE-2026-109379 published to NVD
2026-10-16 - Last updated in NVD database

Technical Details for CVE-2026-109379

Vulnerability Analysis

The vulnerability exists in the login handler of Cockpit CMS. When /auth/check receives credentials, the application branches based on whether the submitted username or email matches an existing account. Valid accounts proceed through two bcrypt hashing operations as part of the authentication workflow. Nonexistent accounts short-circuit after a single bcrypt operation. Because bcrypt is intentionally expensive, this difference produces a response-time gap large enough to measure over the network. An attacker iterating a list of usernames or email addresses can classify each entry as valid or invalid based on timing alone, without needing valid credentials or triggering account-lockout defenses.

Root Cause

The root cause is an incomplete fix for a prior timing-attack issue in the authentication path. The developers added logic intended to equalize work between the "account exists" and "account missing" branches, but the nonexistent-account path still performs one fewer bcrypt computation. The imbalance leaks membership information through side-channel timing [CWE-208].

Attack Vector

The attack is unauthenticated and network-reachable. An attacker sends crafted POST requests to /auth/check containing candidate usernames or email addresses and records server response times. Statistical analysis across repeated requests reveals which candidates correspond to real accounts. The enumerated accounts can then feed credential-stuffing, password-spraying, or targeted phishing campaigns.

php

// Security patch in modules/App/Controller/Auth.php
// Adds a dummy bcrypt hash so the "no account" branch performs
// an equivalent password_verify() call, equalizing timing.
class Auth extends Base {

    protected const DUMMY_PASSWORD_HASH = '$2y$10$e0NR1Z5J8Q6z1F7G9K8eOe5J8Q6z1F7G9K8eOe5J8Q6z1F7G9K8eO';

    protected $layout = 'app:layouts/canvas.php';

    protected function before() {

Source: Cockpit Commit 5d65ae7b

Detection Methods for CVE-2026-109379

Indicators of Compromise

High volumes of POST requests to /auth/check from a single source or small set of sources within a short time window.
Repeated authentication attempts cycling through many distinct usernames or email addresses with few retries per account.
Request patterns that fail at a consistent rate while measuring response latency, often with uniform payload structure.

Detection Strategies

Baseline normal /auth/check traffic volume and alert on statistical deviations from authenticated users or scrapers.
Correlate failed-login events by source IP, user-agent, and request cadence to identify enumeration behavior rather than credential stuffing.
Flag enumeration attempts that touch many unique account identifiers but never progress to successful authentication.

Monitoring Recommendations

Log full request metadata for /auth/check, including source IP, timing, submitted identifier, and response code.
Forward web server and application logs to a centralized analytics platform to support cross-session correlation.
Monitor downstream signals such as sudden spikes in password-reset requests or lockouts that may follow a successful enumeration campaign.

How to Mitigate CVE-2026-109379

Immediate Actions Required

Upgrade Cockpit CMS to a version containing the fix in commit 5d65ae7b63a261a63e8809e5fba857ef3eadb2ac.
Place the Cockpit admin interface behind a VPN, IP allowlist, or reverse-proxy authentication layer where feasible.
Enforce rate limiting and progressive delays on /auth/check to raise the cost of large-scale enumeration.

Patch Information

The upstream fix introduces a constant DUMMY_PASSWORD_HASH and invokes a bcrypt verification against it when no matching account is found. This equalizes the work performed on both branches of the login flow and removes the observable timing signal. Patch details are available in the Cockpit commit and the VulnCheck advisory.

Workarounds

Deploy a web application firewall (WAF) rule to rate-limit and throttle requests to /auth/check per source IP.
Restrict access to the admin login endpoint using network ACLs or authenticated reverse-proxy gateways.
Enable account lockout and CAPTCHA challenges after a small number of failed attempts to deter automated enumeration.

bash

# Example nginx configuration to rate-limit /auth/check
http {
    limit_req_zone $binary_remote_addr zone=authcheck:10m rate=5r/m;

    server {
        location = /auth/check {
            limit_req zone=authcheck burst=5 nodelay;
            proxy_pass http://cockpit_backend;
        }
    }
}