The vulnerability occurs in the authentication check endpoint of Cockpit CMS 2.14.1. It introduces an observable timing difference: authenticating valid accounts triggers two bcrypt hash verifications, while invalid attempts perform only one, creating a detectable latency gap. An unauthenticated attacker can post login attempts, measure response times, and determine which usernames or email addresses correspond to real accounts. This leads to disclosure of legitimate account identifiers and enables further credential‑guessing or social engineering attacks. The weakness is cataloged as CWE‑208, representing an incomplete handling of authentication timing.

Cockpit CMS version 2.14.1 from the vendor Cockpit HQ (cockpit‑hq:cockpit) is affected. No other products or versions are listed in the CNA data, so only installations of this specific release are at risk.

The CVSS score of 6.9 indicates a moderate severity. EPSS score is not available, and the issue is not listed in CISA's KEV catalog. The likely attack vector is an unauthenticated HTTP POST to the /auth/check endpoint, which is reachable from any network location with access to the web service. Exploitation requires only the ability to send repeated login requests and measure timing, making it relatively straightforward for an attacker.