CVE-2026-82449

Cockpit CMS before 2.14.1 is affected by an account enumeration vulnerability in the auth check endpoint (modules/App/Controller/Auth.php). The root cause is a timing discrepancy in password verification: requests for existing accounts trigger a bcrypt hash comparison (slower), while requests for...