CVE-2026-53525WeeChat has Non-Constant-Time Password Hash Comparison in Relay Authentication
Updated under an hour ago ()
Does this affect you?
It affects weechat. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
WeeChat (Wee Enhanced Environment for Chat) is a free chat client. In versions 0.3.1 through 4.9.0, the WeeChat relay authentication uses non-constant-time string comparison functions (weechat_strcasecmp and strcmp) to verify password hashes and plaintext passwords. An attacker can exploit timing differences to extract the server-computed hash character by character, then authenticate using the correct hash without knowing the password. Version 4.9.1 fixes the issue.
- CVSS
- 7.4 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
- Weakness (CWE)
- CWE-208
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- GitHub_M
- NVD analysis
- Deferred
- Record last updated
- Aug 25, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
weechat weechat weechat:weechat (from the name) | from 0.3.4, < 4.9.1 | CNA record |
References
- https://github.com/weechat/weechat/security/advisories/GHSA-vhv8-g2r9-cwccx-refsource-confirm
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.