Cockpit CMS CVE-2026-109379

No special configuration required - remote unauthenticated requests to the default /auth/check login endpoint of Cockpit CMS 2.14.1 are sufficient, because the incomplete prior timing fix leaves existing accounts performing two bcrypt operations versus one for non-existent accounts. Limiting factors: exploitation is a statistical timing side-channel, so network jitter and server load can obscure the signal and typically force many repeated, averaged requests per candidate; the flaw yields only account/email enumeration, not authentication bypass or credential disclosure, and is remediated in the patched build that adds the dummy bcrypt check.

Signals are consistent and point to a genuine-but-moderate issue rather than a top-priority emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms a remotely reachable, low-complexity, unauthenticated vector, which matches the description of an anonymous attacker POSTing to /auth/check. However, impact is confined to confidentiality at LOW (VC:L, VI:N, VA:N): the flaw leaks the existence of usernames/email addresses, not credentials, data, or code execution. No EPSS score was supplied, the CVE is NOT on the CISA KEV list, and no public exploit code is referenced in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The 6.9 score is driven by the easy network vector, not by severe impact. Net: a real, legitimately confirmed weakness (the vendor shipped a dummy-bcrypt fix) best treated as an information-disclosure reconnaissance aid that feeds later credential attacks, not as a standalone critical. No signals conflict with each other here.

An unauthenticated attacker repeatedly POSTs login attempts to /auth/check with candidate usernames or emails and measures server response time. Because an existing account triggers two bcrypt operations while a non-existent one triggers only one, slower responses reveal valid accounts, which the attacker then feeds into password-spraying or phishing. No public exploit code is identified, but the technique is trivially scriptable given the CVSS AV:N/AC:L profile.