CVE-2026-82449: Cockpit CMS Authentication Bypass Flaw

CVE-2026-82449 Overview

Cockpit CMS versions prior to 2.14.1 contain an account enumeration vulnerability in the authentication check endpoint. The flaw stems from timing discrepancies during password verification in the Auth controller. When a submitted username exists, the application executes a bcrypt hash comparison, which is computationally expensive. When the username does not exist, the endpoint returns immediately without performing any hashing work. Attackers can measure the difference in response times across repeated requests to determine which usernames correspond to valid accounts. This side-channel weakness is classified under CWE-208: Observable Timing Discrepancy.

Critical Impact
Unauthenticated remote attackers can enumerate valid Cockpit CMS user accounts, enabling targeted credential stuffing, password spraying, and phishing campaigns against confirmed users.

Affected Products

Cockpit CMS versions before 2.14.1
Cockpit CMS 2.14.0 (modules/App/Controller/Auth.php)
Self-hosted Cockpit CMS deployments exposing the authentication endpoint to untrusted networks

Discovery Timeline

2026-08-29 - CVE-2026-82449 published to NVD
2026-08-31 - Last updated in NVD database

Technical Details for CVE-2026-82449

Vulnerability Analysis

The vulnerability resides in the login flow implemented in modules/App/Controller/Auth.php. The controller receives a username and password, looks up the account, and only invokes password_verify() when a matching user record is found. Because bcrypt hashing is intentionally slow, requests targeting a valid username take measurably longer than requests targeting a non-existent username. An attacker sending a list of candidate usernames can statistically distinguish which values map to real accounts based on response latency.

Account enumeration lowers the cost of downstream attacks. Once a valid username is confirmed, adversaries can direct credential stuffing, password spraying, and social engineering at that identity rather than the full username space. In Cockpit CMS deployments, exposed accounts often include administrator or content editor roles with access to structured content, media, and API tokens.

Root Cause

The root cause is asymmetric work in the authentication path. The absence of a constant-time code path, such as executing a dummy bcrypt comparison for unknown usernames, means the branch taken by the server leaks information about the account database.

Attack Vector

Exploitation requires only network access to the Cockpit CMS auth check endpoint. No authentication, user interaction, or elevated privileges are needed. An attacker scripts repeated POST requests with candidate usernames and a constant password, records response times, and applies statistical analysis to separate valid usernames from invalid ones.

php

// Security patch: introduces a dummy bcrypt hash so that non-existent
// users incur the same verification cost as existing users.
 */
class Auth extends Base {

+    protected const DUMMY_PASSWORD_HASH = '$2y$10$e0NR1Z5J8Q6z1F7G9K8eOe5J8Q6z1F7G9K8eOe5J8Q6z1F7G9K8eO';
+
    protected $layout = 'app:layouts/canvas.php';

    protected function before() {

Source: Cockpit Commit 5d65ae7

Detection Methods for CVE-2026-82449

Indicators of Compromise

High volumes of POST requests to the Cockpit auth check endpoint from a single source IP or small IP range within a short window.
Requests iterating through sequential or dictionary-style usernames while reusing the same password value.
Repeated authentication failures with response times clustered into two distinct latency bands.
User-Agent strings associated with scripting frameworks such as python-requests, curl, or Go-http-client hitting login endpoints.

Detection Strategies

Baseline normal login latency and alert on scripted traffic patterns with abnormally uniform request intervals.
Correlate failed login attempts by source IP against distinct-username counts to identify enumeration behavior.
Inspect web server and reverse proxy logs for enumeration signatures targeting /auth/check or equivalent Cockpit routes.

Monitoring Recommendations

Forward Cockpit CMS application logs, reverse proxy access logs, and WAF telemetry to a centralized analytics platform for correlation.
Track the ratio of unique usernames per source IP over rolling windows to surface enumeration campaigns.
Alert on bursts of 401 or 403 responses to authentication endpoints exceeding a defined per-IP threshold.

How to Mitigate CVE-2026-82449

Immediate Actions Required

Upgrade Cockpit CMS to version 2.14.1 or later, which introduces a constant-time authentication path.
Restrict access to the Cockpit administrative interface using IP allowlists, VPN, or reverse proxy authentication.
Enforce strong, unique passwords and enable multi-factor authentication where supported to reduce impact if usernames are enumerated.
Review authentication logs for prior enumeration activity and rotate credentials for any exposed high-privilege accounts.

Patch Information

The fix is applied in commit 5d65ae7b63a261a63e8809e5fba857ef3eadb2ac and ships in Cockpit CMS 2.14.1. The patch adds a DUMMY_PASSWORD_HASH constant to the Auth controller and executes password_verify() against this dummy hash when a username is not found. This equalizes the cost of the code path, removing the observable timing signal. See the VulnCheck Cockpit CMS Advisory and MFC Security Advisory 2026-001 for vendor references.

Workarounds

Place the Cockpit CMS auth endpoint behind a Web Application Firewall (WAF) with rate-limiting rules for repeated failed logins per source IP.
Introduce reverse-proxy authentication such as HTTP basic auth or mutual TLS in front of /auth routes until the upgrade can be deployed.
Add artificial jitter or a minimum response time to authentication responses at the proxy layer to reduce the signal-to-noise ratio of timing measurements.
Temporarily disable public access to the administrative login page by binding it to an internal network segment.

bash

# Example NGINX rate limit for the Cockpit auth endpoint
limit_req_zone $binary_remote_addr zone=cockpit_auth:10m rate=10r/m;

server {
    location /auth/check {
        limit_req zone=cockpit_auth burst=5 nodelay;
        limit_req_status 429;
        proxy_pass http://cockpit_backend;
    }
}