CVE-2026-53525highCWE-208

CVE-2026-53525: falha de alta gravidade em weechat

WeeChat has Non-Constant-Time Password Hash Comparison in Relay Authentication

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar weechat+ Monitorar weechat

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.4epss 0.4%
WeeChat (Wee Enhanced Environment for Chat) is a free chat client. In versions 0.3.1 through 4.9.0, the WeeChat relay authentication uses non-constant-time string comparison functions (weechat_strcasecmp and strcmp) to verify password hashes and plaintext passwords. An attacker can exploit timing differences to extract the server-computed hash character by character, then authenticate using the correct hash without knowing the password. Version 4.9.1 fixes the issue.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
Produtos afetados
weechat · weechat
CVEs relacionadas — weechat

No mesmo produto, das mais perigosas para as menos.

CVE-2026-53524MEDIUMWeeChat has a Decompression Bomb in Relay WebSocket (DoS)EPSS 0.5%