CVE-2026-53525 describes a vulnerability in Weechat where the password hash comparison during relay authentication is not performed in constant time. This flaw can lead to timing side-channel attacks that may allow an attacker to compromise the integrity and availability of the affected system. The vulnerability affects numerous specific Weechat versions as listed. There is no information about known exploits in the wild or vendor-provided patches. The CVSS 3.1 vector indicates the attack requires network access with high complexity and no privileges or user interaction, impacting integrity and availability but not confidentiality.

The vulnerability allows an attacker to exploit timing differences in password hash comparison, potentially leading to unauthorized actions that compromise the integrity and availability of the Weechat service. Confidentiality is not impacted. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fixes or patches are provided in the available data. Users should monitor vendor communications for updates and consider restricting network access to the relay authentication feature as a precaution.