Home / Vulnerability Intelligence / CVE-2026-26206

CVE-2026-26206 - Vulnerability Analysis

MediumCVSS: 6.5

Last Updated: April 30, 2026

Wazuh - Authentication Bypass

Published: April 29, 2026Updated: April 30, 2026PoC AvailableRemote Exploitable

Overview

Wazuh 4.0.0 to < 4.14.4 contains a brute force protection bypass caused by concurrent authentication requests in server API POST /security/user/authenticate, letting attackers perform more password guesses than intended, exploit requires sending parallel requests.

Severity & Score

Severity: Medium

CVSS Score: 6.5

Impact

Attackers can perform more password guesses than allowed, increasing risk of successful brute-force authentication.

Mitigation

Upgrade to version 4.14.4 or later.

References

https://github.com/wazuh/wazuh/releases/tag/v4.14.4
https://github.com/wazuh/wazuh/security/advisories/GHSA-m2mr-xhhv-jx58

Related Resources

Vulnerability Intelligence Dashboard
Credential Scanner

Details

CVE ID: CVE-2026-26206
Severity: Medium
CVSS Score: 6.5
Type: broken_authentication
Status: confirmed

CWE

CWE-307

CVSS Metrics

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N