CVE-2026-109379: Observable Timing Discrepancy in cockpit-hq cockpit

CVE-2026-109379 describes an observable timing discrepancy vulnerability in Cockpit CMS 2.14.1. The vulnerability arises from an incomplete timing fix in the /auth/check authentication endpoint. Attackers can send login attempts and measure the response times to distinguish valid accounts from invalid ones. Specifically, valid accounts trigger two bcrypt operations, whereas invalid accounts trigger only one, leading to a timing difference that can be exploited for user enumeration without authentication.

The vulnerability enables unauthenticated attackers to enumerate valid usernames and email addresses by measuring response times during login attempts. This information disclosure can facilitate further targeted attacks such as credential stuffing or phishing. There is no indication of direct code execution or data modification from this vulnerability alone.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider implementing additional rate limiting or monitoring to detect abnormal login attempt patterns that could indicate enumeration attempts.