CVE-2026-93346

Wazuh versions 4.0.0 through 4.14.7 are vulnerable to a race condition in the API login throttling mechanism. This flaw allows unauthenticated attackers to bypass max_login_attempts by sending concurrent login bursts to the authenticate and run_as endpoints. Because each request may pass the bloc...