The vulnerability, which is a timing side‑channel vulnerability (CWE‑208), resides in the AuthenticationManager.check_user() routine in Wazuh's RBAC module. When a username is supplied the system first verifies its existence; non‑existent usernames trigger an immediate return whereas existing usernames trigger a computationally expensive bcrypt hash comparison. An attacker who is unable to authenticate can exploit this timing discrepancy between the two paths to determine which usernames are valid, enabling user enumeration. This information can then be used to focus further credential‑guessing or phishing efforts against legitimate users.

The flaw is present in the Wazuh platform, specifically in the framework/wazuh/rbac/orm.py implementation. Versions from 4.0.0 up to, but not including, 4.14.6, and from the 5.0.0‑beta1 release up to, but not including, 5.0.0‑beta2, are affected. The issue is fixed in Wazuh 4.14.6 and 5.0.0‑beta2, and all later releases.

The CVSS score of 5.3 denotes a moderate impact. EPSS information is not available, indicating that the current exploitation probability is unknown but likely low. The vulnerability is not listed in the CISA KEV catalog, and no specific exploit has been reported. The attack vector is remote and does not require authentication, relying on timing side‑channels observed over network connections to the authentication endpoint. An attacker can conduct a series of authentication attempts, measure response latencies, and derive a list of valid usernames, which then facilitates more targeted attacks.