{"id":"CVE-2026-53525","aliases":["DEBIAN-CVE-2026-53525","EUVD-2026-64186","GHSA-vhv8-g2r9-cwcc","MGASA-2026-0561","UBUNTU-CVE-2026-53525","openSUSE-SU-2026:11481-1","openSUSE-SU-2026:21615-1"],"status":"published","title":"WeeChat has Non-Constant-Time Password Hash Comparison in Relay Authentication","description":"WeeChat (Wee Enhanced Environment for Chat) is a free chat client. In versions 0.3.1 through 4.9.0, the WeeChat relay authentication uses non-constant-time string comparison functions (weechat_strcasecmp and strcmp) to verify password hashes and plaintext passwords. An attacker can exploit timing differences to extract the server-computed hash character by character, then authenticate using the correct hash without knowing the password. Version 4.9.1 fixes the issue.","severity":{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00432,"percentile":0.37874,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-208"],"published":"2026-08-09T00:00:00Z","modified":"2026-10-28T02:30:26Z","fixes":[{"ecosystem":"Debian:14","package":"weechat","fixed_in":["4.9.3-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"weechat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.8-1","4.0.1-1","4.0.2-1","4.0.5-1","4.1.1-1","4.10.0-1","4.3.1-1","4.4.2-1","4.4.3-1","4.4.3-1~bpo12+1","4.5.1-1","4.6.1-1","4.6.3-1","4.6.3-1~bpo12+1","4.7.2-1","4.8.1-1","4.9.0-1","4.9.3-1","4.9.4-1","4.9.5-1"]},{"source":"osv","ecosystem":"Debian:13","package":"weechat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.10.0-1","4.6.3-1","4.7.2-1","4.8.1-1","4.9.0-1","4.9.3-1","4.9.4-1","4.9.5-1"]},{"source":"osv","ecosystem":"Debian:14","package":"weechat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.3-1"}]}],"versions":["4.6.3-1","4.7.2-1","4.8.1-1","4.9.0-1"]},{"source":"osv","ecosystem":"Mageia:10","package":"weechat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10.0-1.mga10"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"weechat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3-1","1.3-1build1","1.4-1","1.4-1build1","1.4-1build2","1.4-2","1.4-2ubuntu0.1","1.4-2ubuntu0.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"weechat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.9.1-1","1.9.1-1build1","1.9.1-1ubuntu1","1.9.1-1ubuntu1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"weechat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.6-2","2.6-2build1","2.6-2build2","2.6-2ubuntu1","2.6-2ubuntu2","2.8-1","2.8-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"weechat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.3-1","3.3-1ubuntu1","3.4-2","3.4-2build1","3.4-2build2","3.4.1-1","3.5-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"weechat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.0.5-1","4.1.1-1","4.1.1-1build2","4.1.1-1build3","4.1.1-1build6","4.1.1-1build7"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"weechat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.6.3-1build1","4.7.2-1","4.8.1-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"weechat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10.0-1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"weechat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10.0-bp160.1.1"}]}],"bundled":2}],"products":[{"vendor":"weechat","product":"weechat"}],"references":[{"url":"https://github.com/weechat/weechat/security/advisories/GHSA-vhv8-g2r9-cwcc","tags":["x_refsource_CONFIRM","exploit","advisory","report"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53525.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53525","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-53525","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0561.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36178","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/VFSQ7FTIVCLLWHLTI3PZWITYB7QEHYLO/","tags":["web"]},{"url":"https://github.com/weechat/weechat/security/advisories/GHSA-v2v4-45wm-5cr3","tags":["advisory"]},{"url":"https://weechat.org/doc/weechat/security/WSA-2026-1/","tags":["web"]},{"url":"https://weechat.org/doc/weechat/security/WSA-2026-2/","tags":["web","report"]},{"url":"https://ubuntu.com/security/CVE-2026-53525","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-53525","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53524","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53525","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-53525","title":"WeeChat has Non-Constant-Time Password Hash Comparison in Relay Authentication","description":"WeeChat (Wee Enhanced Environment for Chat) is a free chat client. In versions 0.3.1 through 4.9.0, the WeeChat relay authentication uses non-constant-time string comparison functions (weechat_strcasecmp and strcmp) to verify password hashes and plaintext passwords. An attacker can exploit timing differences to extract the server-computed hash character by character, then authenticate using the correct hash without knowing the password. Version 4.9.1 fixes the issue.","status":"published","published":"2026-08-21T22:19:21.278Z","modified":"2026-08-25T16:46:03.941Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-208"],"updated_at":"2026-11-02T14:20:00.11477Z"}],"euvd":[{"id":"EUVD-2026-64186","description":"WeeChat (Wee Enhanced Environment for Chat) is a free chat client. In versions 0.3.1 through 4.9.0, the WeeChat relay authentication uses non-constant-time string comparison functions (weechat_strcasecmp and strcmp) to verify password hashes and plaintext passwords. An attacker can exploit timing differences to extract the server-computed hash character by character, then authenticate using the correct hash without knowing the password. Version 4.9.1 fixes the issue.","status":"published","published":"2026-08-21T22:19:21Z","modified":"2026-08-25T16:46:03Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T18:01:32.513581Z"}],"nvd":[{"id":"CVE-2026-53525","description":"WeeChat (Wee Enhanced Environment for Chat) is a free chat client. In versions 0.3.1 through 4.9.0, the WeeChat relay authentication uses non-constant-time string comparison functions (weechat_strcasecmp and strcmp) to verify password hashes and plaintext passwords. An attacker can exploit timing differences to extract the server-computed hash character by character, then authenticate using the correct hash without knowing the password. Version 4.9.1 fixes the issue.","status":"published","published":"2026-08-21T23:16:26.363Z","modified":"2026-10-14T19:10:00.297Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-208"],"updated_at":"2026-11-02T14:12:40.665005Z"}],"osv":[{"id":"CVE-2026-53525","title":"WeeChat has Non-Constant-Time Password Hash Comparison in Relay Authentication","description":"WeeChat (Wee Enhanced Environment for Chat) is a free chat client. In versions 0.3.1 through 4.9.0, the WeeChat relay authentication uses non-constant-time string comparison functions (weechat_strcasecmp and strcmp) to verify password hashes and plaintext passwords. An attacker can exploit timing differences to extract the server-computed hash character by character, then authenticate using the correct hash without knowing the password. Version 4.9.1 fixes the issue.","status":"published","published":"2026-08-21T22:19:21.278Z","modified":"2026-10-28T02:30:26.349203747Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"high"}],"cwes":["CWE-208"],"updated_at":"2026-11-02T15:45:08.132336Z"},{"id":"DEBIAN-CVE-2026-53525","description":"WeeChat (Wee Enhanced Environment for Chat) is a free chat client. In versions 0.3.1 through 4.9.0, the WeeChat relay authentication uses non-constant-time string comparison functions (weechat_strcasecmp and strcmp) to verify password hashes and plaintext passwords. An attacker can exploit timing differences to extract the server-computed hash character by character, then authenticate using the correct hash without knowing the password. Version 4.9.1 fixes the issue.","status":"published","published":"2026-08-21T23:16:26.363Z","modified":"2026-10-15T09:47:38.871914556Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:57.236551Z"},{"id":"UBUNTU-CVE-2026-53525","description":"WeeChat (Wee Enhanced Environment for Chat) is a free chat client. In versions 0.3.1 through 4.9.0, the WeeChat relay authentication uses non-constant-time string comparison functions (weechat_strcasecmp and strcmp) to verify password hashes and plaintext passwords. An attacker can exploit timing differences to extract the server-computed hash character by character, then authenticate using the correct hash without knowing the password. Version 4.9.1 fixes the issue.","status":"published","published":"2026-08-21T23:16:00Z","modified":"2026-09-02T19:36:19.868198546Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:41.382716Z"},{"id":"MGASA-2026-0561","title":"Updated weechat package fixes security vulnerabilities","description":"Decompression Bomb in Relay WebSocket (DoS). (CVE-2026-53524)\nNon-Constant-Time Password Hash Comparison in Relay Authentication.\n(CVE-2026-53525)\n","status":"published","published":"2026-10-27T20:02:56Z","modified":"2026-10-27T20:15:06.459360695Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:11481-1","title":"weechat-4.10.0-1.1 on GA media","description":"These are all security issues fixed in the weechat-4.10.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-08-09T00:00:00Z","modified":"2026-08-10T08:15:09.384915577Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:21615-1","title":"Security update for weechat","description":"This update for weechat fixes the following issues:\n\nChanges in weechat:\n\n- Update to 4.10.0:\n\n  Added\n  * core: add command /theme (#1338)\n  * core: add built-in \"light\" theme, applied automatically on first\n    start on light-background terminals (#1338)\n  * core: add themable flag on configuration options (#1338)\n  * core: add options weechat.look.theme and\n    weechat.look.theme_backup (#1338)\n  * api: add function theme_register (#1338)\n  * fset: add filter t:themable (#1338)\n  * relay/api: add resource GET /api/scripts\n  * relay: add option relay.network.unix_socket_permissions (#2317)\n  * script: add info \"script_languages\"\n\n  Changed\n  * core: improve speed of /upgrade with a lot of buffers and lines\n    (#2338, #2339, #2341)\n  * core: improve speed of display of long words in chat area (#2336)\n  * core: add condition on connected relay api clients in default\n    value of option weechat.look.hotlist_add_conditions\n  * core: add /mute in default command for key Alt+= (toggle filters)\n  * api: change type of parameter \"pos_option_name\" to \"const char **\"\n    in function config_search_with_string\n  * relay/api: add field \"last_read_line_id\" in GET /api/buffers\n\n  Fixed\n  * core: fix infinite loop when option weechat.look.read_marker_string\n    is set to a string with a width of zero (#2337)\n  * core: fix option weechat.look.color_real_white not applied when\n    color is \"white\" on 16+ colors terminals (#1742)\n  * core: fix buffer overflow in connection to SOCKS5 proxy (#2325)\n  * api: fix infinite loop in function string_replace when the search\n    string is empty\n  * api: do not free dynamic string on error in function string_dyn_concat\n  * irc: fix tag in message with list of names when joining a channel\n  * fset: remove error displayed in core buffer when clicking with the\n    mouse below the last option displayed\n  * guile, lua, perl, python, ruby, tcl: fix conversion of dates in\n    the API functions\n  * irc: fix conversion of dates in received messages\n\n  Security\n  * core: fix buffer overflow in display of time in chat area with a\n    custom time format (#2342)\n  * core: fix integer overflow in size calculation when evaluating\n    \"${hide:...}\" and \"${base_encode:...}\" (#2335)\n  * core: fix possible buffer overflow in command /color alias (#2330)\n  * core: fix possible buffer overflow in list of commands displayed\n    by /help (#2330)\n  * irc: fix heap use-after-free when a batched message causes a\n    disconnection from the server (GHSA-rfmh-3r7f-jpx5)\n  * irc: fix stack buffer overflow when splitting a JOIN message\n    with a large list of channels and keys (GHSA-q2xg-9ggx-77mr)\n  * irc: limit size of data received from the server to prevent\n    memory exhaustion\n  * irc: fix out-of-bounds read on incoming DCC command with a\n    quoted filename ending the message (#2322)\n  * logger: fix path traversal in log file name when a buffer local\n    variable contains the char used internally to protect directory\n    separators (#2340)\n  * relay: fix use-after-free and double free on remote buffer\n    (GHSA-hx59-4hq9-6vmw)\n  * relay: fix authentication bypass with the \"plain\" password hash\n    algorithm (GHSA-68ff-gq39-pqjm)\n  * relay: limit size of decompressed websocket frame with\n    permessage-deflate to prevent memory exhaustion\n    (GHSA-v2v4-45wm-5cr3, CVE-2026-53524)\n  * relay: limit size of received websocket frame and HTTP body to\n    prevent memory exhaustion\n  * relay: limit size of partial message received while reading an\n    HTTP request to prevent memory exhaustion\n  * relay: fix timing attack on password authentication\n    (GHSA-vhv8-g2r9-cwcc, CVE-2026-53525)\n  * relay: fix out-of-bounds read in dump of data (#2324)\n  * relay/api: fix memory leak in resources \"handshake\", \"input\" and\n    \"completion\" (GHSA-wmpc-m6g9-fwj8)\n  * relay: fix read of uncompressed websocket frame (#2331)\n  * api, relay: fix timing attack on TOTP validation\n    (GHSA-vhv8-g2r9-cwcc, CVE-2026-53525)\n  * xfer: replace directory separator in remote nick by underscore\n    in download filename to prevent writing the file outside the\n    download directory (#2321)\n  * xfer: fix out-of-bounds read when receiving empty line in DCC\n    chat (#2323)\n  * xfer: fix out-of-bounds write in xfer file transfer resume (#2326)\n\n- Update to 4.9.5:\n  * core: fix buffer overflow in display of time in chat area with a\n    custom time format (#2342)\n  * irc: fix heap use-after-free when a batched message causes a\n    disconnection from the server (GHSA-rfmh-3r7f-jpx5)\n  * irc: fix stack buffer overflow when splitting a JOIN message with\n    a large list of channels and keys (GHSA-q2xg-9ggx-77mr)\n  * relay: fix use-after-free and double free on remote buffer\n    (GHSA-hx59-4hq9-6vmw)\n  * relay: increase max size for decompressed websocket frame\n\n- Update to 4.9.4:\n\n  Changed\n  * core: improve speed of display of long words in chat area (#2336)\n\n  Fixed\n  * core: fix infinite loop when option weechat.look.read_marker_string\n    is set to a string with a width of zero (#2337)\n  * core: fix integer overflow in size calculation when evaluating\n    \"${hide:...}\" and \"${base_encode:...}\" (#2335)\n  * logger: fix path traversal in log file name when a buffer local\n    variable contains the char used internally to protect directory\n    separators (#2340)\n  * relay: fix authentication bypass with the \"plain\" password hash\n    algorithm (GHSA-68ff-gq39-pqjm)\n\n- Update to 4.9.3:\n  * core: fix buffer overflow in connection to SOCKS5 proxy (#2325)\n  * core: fix possible buffer overflow in command /color alias (#2330)\n  * core: fix possible buffer overflow in list of commands displayed\n    by /help (#2330)\n  * api: do not free dynamic string on error in function string_dyn_concat\n  * relay/api: fix memory leak in resources \"handshake\", \"input\" and\n    \"completion\" (GHSA-wmpc-m6g9-fwj8)\n  * relay: fix read of uncompressed websocket frame (#2331)\n  * xfer: fix out-of-bounds write in xfer file transfer resume (#2326)\n\n- Update to 4.9.2:\n  * api: fix infinite loop in function string_replace when the search\n    string is empty\n  * irc: limit size of data received from the server to prevent\n    memory exhaustion\n  * irc: fix out-of-bounds read on incoming DCC command with a quoted\n    filename ending the message (#2322)\n  * relay: limit size of received websocket frame and HTTP body to\n    prevent memory exhaustion\n  * relay: limit size of partial message received while reading an\n    HTTP request to prevent memory exhaustion\n  * relay: fix out-of-bounds read in dump of data (#2324)\n  * xfer: replace directory separator in remote nick by underscore in\n    download filename to prevent writing the file outside the download\n    directory (#2321)\n  * xfer: fix out-of-bounds read when receiving empty line in DCC\n    chat (#2323)\n\n-  Update to 4.9.1:\n   * core: fix option weechat.look.color_real_white not applied when\n     color is \"white\" on 16+ colors terminals (#1742)\n   * irc: fix tag in message with list of names when joining a channel\n   * relay: limit size of decompressed websocket frame with\n     permessage-deflate to prevent memory exhaustion (GHSA-v2v4-45wm-5cr3)\n   * relay: fix timing attack on password authentication (GHSA-vhv8-g2r9-cwcc)\n   * api, relay: fix timing attack on TOTP validation (GHSA-vhv8-g2r9-cwcc)\n\n- Update to 4.9.0:\n\n  Added\n  * typing: add option typing.look.item_text (#2305)\n\n  Fixed\n  * core: fix crash with /eval when the current buffer is closed in a\n    command\n  * core: fix buffer size in function util_parse_time, causing buffer\n    overflow error in unit tests\n  * irc: fix display of CTCP query sent multiple times to the same\n    user when capability echo-message is enabled (#2309)\n  * irc: fix unit of server option anti_flood from seconds to\n    milliseconds in output of /server listfull\n  * irc: fix creation of irc.msgbuffer option without a server name\n  * irc: ignore self join if the channel is already joined (#2291)\n  * relay/api: fix memory leaks in resources \"ping\" and \"sync\"\n  * relay/api: fix memory leak in receive of message from remote WeeChat\n\n- Update to 4.8.2:\n  * irc: ignore self join if the channel is already joined (#2291)\n  * relay/api: fix memory leaks in resources \"ping\" and \"sync\"\n  * relay/api: fix memory leak in receive of message from remote WeeChat\n\n- Update to 4.8.1:\n  * core: fix buffer size in function util_parse_time, causing buffer\n    overflow error in unit tests\n  * irc: fix creation of irc.msgbuffer option without a server name\n\n- Update to 4.8.0:\n\n  Removed\n  * irc: remove temporary servers and option irc.look.temporary_servers\n\n  Changed\n  * api: add support of date like ISO 8601 but with spaces and lower\n    t and z in function util_parse_time (#886)\n  * irc: request and perform SASL authentication when the server\n    advertises SASL support with message \"CAP NEW\" (#2277)\n  * irc: send SASL username with mechanism EXTERNAL (#2270)\n  * logger: change default time format to %@%F %T.%fZ (UTC) (#886)\n  * logger: use function util_parse_time to parse date/time in log\n    files (#886)\n  * relay/api: return an error 400 (Bad Request) when URL parameters\n    \"colors\", \"nicks\", \"lines\" and \"lines_free\" have an invalid value\n  * relay/api: return an error 401 (Unauthorized) when header\n    \"x-weechat-totp\" has an invalid value\n  * xfer: add buffer local variable \"server\" in DCC CHAT buffers\n  * core, irc, relay: add tag \"tls\" in gnutls messages\n  * irc: add tags \"irc_cap\" and \"log3\" in client capability request\n    and SASL not supported messages\n  * build: require Curl ≥ 7.68.0 (#2268)\n  * build: require GnuTLS ≥ 3.6.3 (#2268)\n  * build: require libgcrypt ≥ 1.8.0 (#2268)\n  * build: require Enchant v2 (#2268)\n  * build: require Lua ≥ 5.3 (#2268)\n\n  Added\n  * core: add option weechat.completion.cycle\n  * core: add hdata for hooks\n  * api: add functions util_parse_int, util_parse_long and\n    util_parse_longlong\n  * buflist: add variable ${index_displayed}\n\n  Fixed\n  * core: display an error message in case of invalid parameters in\n    commands /bar, /buffer, /cursor, /print and /window\n  * api: fix file descriptor leak in hook_url when a timeout occurs\n    or if the hook is removed during the transfer (#2284)\n  * api: fix parsing of date/times with timezone offset in function\n    util_parse_time\n  * irc: fix warning on creation of irc.msgbuffer option when the\n    server name contains upper case letters (#2281)\n  * irc: display a warning for each unknown or invalid server option\n    in commands /connect and /server\n  * irc: fix colors in messages 367 (ban mask), 728 (quiet mask) and\n    MODE (#2286)\n  * irc: fix reset of color when multiple modes are set with\n    command /mode\n  * relay/api: fix crash when an invalid HTTP request is received\n    from a client\n  * relay/api: return HTTP error 404 instead of 400 when the buffer\n    is not found in resources completion and input\n  * relay/api: return HTTP error 400 in case of invalid body in\n    resource ping\n","status":"published","published":"2026-08-20T16:20:15Z","modified":"2026-08-23T18:23:37.659655553Z","updated_at":"2026-11-02T16:58:41.885092Z"}]}}