CVE-2026-109379

A flaw was found in Cockpit. An observable timing discrepancy in the authentication mechanism allows an unauthenticated remote attacker to enumerate valid user accounts. By submitting login requests and measuring response times, an attacker can identify whether a username or email address exists...