EUVD-2026-26268Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Network-accessible unauthenticated endpoint (AV:N, PR:N, UI:N) with no complexity barrier (AC:L); C:L and I:L reflect potential credential compromise rather than direct system impact; A:N as the bypass itself causes no availability harm.
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
6DescriptionGitHub Advisory
Wazuh is a free and open source platform used for threat prevention, detection, and response. From version 4.0.0 to before version 4.14.4, Wazuh's server API brute-force protection for POST /security/user/authenticate can be bypassed by sending concurrent authentication requests. Although the configured threshold (max_login_attempts, default 50) is enforced correctly for sequential requests, a parallel burst allows significantly more failed login attempts to be processed before the IP block is applied. This enables an attacker to perform more password guesses than the configured policy intends (e.g., 100 attempts processed where 50 should be allowed). This issue has been patched in version 4.14.4.
AnalysisAI
Wazuh's server API brute-force protection on POST /security/user/authenticate is bypassable via concurrent request flooding in versions 4.0.0 through 4.14.3, allowing unauthenticated remote attackers to submit substantially more credential guesses than the configured max_login_attempts policy (default: 50) permits. The race condition in the IP-block enforcement logic processes parallel HTTP bursts before the counter triggers a block, effectively multiplying password guessing capacity - for example, processing 100 attempts where only 50 should be permitted. No public exploit is confirmed in KEV, but SSVC classifies exploitation status as POC and automatable, while EPSS at 0.05% (14th percentile) indicates limited observed in-the-wild activity. Vendor-released patch version 4.14.4 resolves the issue.
Technical ContextAI
Wazuh is an open-source SIEM and XDR platform (cpe:2.3:a:wazuh:wazuh:*:*:*:*:*:*:*:*) providing threat detection, prevention, and response capabilities. The vulnerability maps to CWE-307 (Improper Restriction of Excessive Authentication Attempts), a class of flaw where rate-limiting or lockout mechanisms are not implemented atomically under concurrent load. The Wazuh RESTful API endpoint POST /security/user/authenticate enforces max_login_attempts correctly for sequential requests by incrementing a per-IP counter, but because the counter check and block application are not serialized under concurrent access, multiple parallel requests can all pass the check before any single one triggers the block. This is a classic TOCTOU (time-of-check to time-of-use) variant at the application layer. The vulnerability has been present since version 4.0.0, suggesting the race condition was introduced early in the API architecture and persisted undetected across multiple major releases.
RemediationAI
The primary fix is upgrading to Wazuh 4.14.4, confirmed by the vendor release at https://github.com/wazuh/wazuh/releases/tag/v4.14.4 and security advisory GHSA-m2mr-xhhv-jx58. For deployments unable to upgrade immediately, restrict network access to the Wazuh API (default port 55000) to trusted management hosts only using firewall rules or network segmentation - this eliminates remote unauthenticated access entirely and is the highest-impact compensating control. Lowering the max_login_attempts configuration value reduces the per-burst window of opportunity but does not eliminate the race condition and may cause legitimate lockouts. Enabling alerting on high-frequency parallel authentication events to the API endpoint provides detection capability in the interim. Note that the release notes for v4.14.4 also include fixes for heap-based null write buffer underflows in the manager and agent components, making the upgrade advisable beyond just this CVE.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
In the wazuh-slack active response script in Wazuh 4.2.x before 4.2.5, untrusted user agents are passed to a curl comman
Path-traversal-driven root code execution affects the Wazuh security platform's cluster synchronization layer in version
Arbitrary file read in Wazuh cluster deployments (4.0.0 through 4.14.5, and 5.0.0-beta1/beta2) lets a peer node that alr
Arbitrary file write leading to root remote code execution affects Wazuh worker nodes in clustered deployments running v
A critical deserialization vulnerability in Wazuh's cluster mode allows attackers with access to any worker node to achi
Path traversal in Wazuh's ip-customblock active response script allows low-privileged remote attackers to create or dele
The agent in OSSEC through 3.1.0 on Windows allows local users to gain NT AUTHORITY\SYSTEM access via Directory Traversa
Cluster key disclosure in Wazuh Manager versions 4.0.0 through 4.14.4 enables a two-stage privilege escalation: a low-pr
CVE-2024-1243 is an improper input validation vulnerability in Wazuh agent for Windows (versions prior to 4.8.0) that al
Argument injection in Wazuh active response scripts (versions 4.2.0-4.14.6) allows a low-privileged network attacker who
Cluster secret exposure in Wazuh 4.14.0-4.14.6 stems from a logic inversion in the RBAC masking gate that counterintuiti
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today