Cockpit CMS 2.14.1 Account Enumeration via Timing Discrepancy in /auth/check

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-109379 · Microsoft / collected KEV context

cve-program · CVE-2026-109379

• https://github.com/Cockpit-HQ/Cockpit/issues/328
• https://github.com/Cockpit-HQ/Cockpit/blob/2.14.1/modules/App/Controller/Auth.php
• https://github.com/Cockpit-HQ/Cockpit/blob/2.14.1/modules/App/Helper/Auth.php
• https://github.com/Cockpit-HQ/Cockpit/commit/5d65ae7b63a261a63e8809e5fba857ef3eadb2ac
• https://github.com/Cockpit-HQ/Cockpit
• https://www.vulncheck.com/advisories/cockpit-cms-2.14.1-account-enumeration-via-timing-discrepancy-in-auth-check

No related operational record is retained in the current change model.