CVE-2026-82449: Observable Timing Discrepancy in cockpit-hq cockpit

CVE-2026-82449 describes an account enumeration vulnerability in cockpit-hq's Cockpit CMS before version 2.14.1. The vulnerability arises from observable timing differences in the authentication check endpoint's password verification process. Specifically, when an account exists, the system performs bcrypt verification which introduces a measurable delay, whereas non-existent accounts return immediately. This timing discrepancy allows attackers to infer valid usernames by analyzing response times across multiple requests.

The vulnerability allows attackers to enumerate valid user accounts on affected Cockpit CMS installations. While it does not directly lead to unauthorized access or privilege escalation, account enumeration can facilitate targeted attacks such as phishing or brute force attempts against known accounts.

Upgrade Cockpit CMS to version 2.14.1 or later, where this timing discrepancy vulnerability has been addressed. Patch status is confirmed by the version boundary indicating fixed in 2.14.1. No additional mitigations are specified.