Description
Wazuh is a free and open source platform used for threat prevention, detection, and response. From version 4.0.0 to before version 4.14.4, Wazuh's server API brute-force protection for POST /security/user/authenticate can be bypassed by sending concurrent authentication requests. Although the configured threshold (max_login_attempts, default 50) is enforced correctly for sequential requests, a parallel burst allows significantly more failed login attempts to be processed before the IP block is applied. This enables an attacker to perform more password guesses than the configured policy intends (e.g., 100 attempts processed where 50 should be allowed). This issue has been patched in version 4.14.4.
Published: 2026-04-29
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Wazuh’s API endpoint POST /security/user/authenticate incorporates brute‑force protection that counts failed login attempts and blocks an IP after a configurable threshold. The vulnerability is a race condition caused by concurrent authentication requests, allowing more failed attempts to be processed before the block is enforced. As a result, attackers can bypass the intended rate limiting and attempt additional login guesses beyond the threshold, reducing the effectiveness of the security policy.

Affected Systems

The issue affects the Wazuh server API across all releases from version 4.0.0 up to, but not including, 4.14.4. Users running any of these versions are exposed unless they upgrade to 4.14.4 or later.

Risk and Exploitability

The CVSS score of 6.5 indicates a moderate severity; the EPSS score is not published, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that attackers would need to send a high volume of concurrent authentication requests over the public API to trigger the race condition, making the risk real for exposed services. The problem is mitigated when the server is upgraded to 4.14.4 where the race condition is resolved.

Generated by OpenCVE AI on April 30, 2026 at 03:56 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the Wazuh server to version 4.14.4 or later to eliminate the race condition.
  • If an immediate upgrade is not possible, implement API rate limiting or firewall rules to restrict the number of concurrent authentication requests.
  • As a temporary workaround, increase the max_login_attempts threshold to a higher value while monitoring for abnormal failed login activity.
  • Enable logging of authentication attempts and review logs for suspicious patterns.

Generated by OpenCVE AI on April 30, 2026 at 03:56 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 30 Apr 2026 20:45:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:wazuh:wazuh:*:*:*:*:*:*:*:*

Wed, 29 Apr 2026 19:45:00 +0000

Type Values Removed Values Added
First Time appeared Wazuh
Wazuh wazuh
Vendors & Products Wazuh
Wazuh wazuh

Wed, 29 Apr 2026 19:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 29 Apr 2026 18:30:00 +0000

Type Values Removed Values Added
Description Wazuh is a free and open source platform used for threat prevention, detection, and response. From version 4.0.0 to before version 4.14.4, Wazuh's server API brute-force protection for POST /security/user/authenticate can be bypassed by sending concurrent authentication requests. Although the configured threshold (max_login_attempts, default 50) is enforced correctly for sequential requests, a parallel burst allows significantly more failed login attempts to be processed before the IP block is applied. This enables an attacker to perform more password guesses than the configured policy intends (e.g., 100 attempts processed where 50 should be allowed). This issue has been patched in version 4.14.4.
Title Wazuh: API brute-force protection bypass via race condition in login attempt tracking
Weaknesses CWE-307
CWE-362
CWE-367
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N'}

Subscriptions

Wazuh Wazuh
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-04-29T18:51:59.594Z

Reserved: 2026-02-11T19:56:24.814Z

Link: CVE-2026-26206

cve-icon Vulnrichment

Updated: 2026-04-29T18:50:23.679Z

cve-icon NVD

Status : Analyzed

Published: 2026-04-29T19:16:22.600

Modified: 2026-04-30T20:38:48.230

Link: CVE-2026-26206

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-30T04:00:15Z

Weaknesses