CVE-2026-53525 - WeeChat has Non-Constant-Time Password Hash Comparison in Relay Authentication
Brief
CVE ID : CVE-2026-53525
Published : Aug. 21, 2026, 11:16 p. m.
- 1 hour, 54 minutes ago
Description : WeeChat (Wee Enhanced Environment for Chat) is a free chat client. In versions 0.
- 1 through 4.
- 0, the WeeChat relay authentication uses non-constant-time string comparison functions (weechat_strcasecmp and strcmp) to verify password hashes and plaintext passwords.
An attacker can exploit timing differences to extract the server-computed hash character by character, then authenticate using the correct hash without knowing the password. Version 4.
- 1 fixes the issue.
Severity: 7.4
- HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...