CVE-2026-53525

Published: Aug 21, 2026Modified: Aug 25, 2026

7.4

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H

Exploitability: 2.2 / Impact: 5.2

Source: security-advisories@github.com (Secondary)

Description

WeeChat (Wee Enhanced Environment for Chat) is a free chat client. In versions 0.3.1 through 4.9.0, the WeeChat relay authentication uses non-constant-time string comparison functions (weechat_strcasecmp and strcmp) to verify password hashes and plaintext passwords. An attacker can exploit timing differences to extract the server-computed hash character by character, then authenticate using the correct hash without knowing the password. Version 4.9.1 fixes the issue.

Related CWEs

CWE-208

Observable Timing Discrepancy

Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not.

References (2)

https://github.com/weechat/weechat/security/advisories/GHSA-vhv8-g2r9-cwcc

Source: security-advisories@github.com

https://github.com/weechat/weechat/security/advisories/GHSA-vhv8-g2r9-cwcc

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.