WeeChat’s relay authentication compares password hashes using non‑constant‑time string functions. An attacker who can observe the timing of these comparisons can perform a timing side‑channel attack, determining the server‑computed hash one character at a time. Once the full hash is recovered, the attacker can authenticate to the relay with that hash even without knowing the original password, effectively bypassing authentication controls. This vulnerability allows unauthorized access to chat sessions and any resources protected by the relay.

The affected product is WeeChat versions 0.3.1 through 4.9.0. The maintainers released version 4.9.1 with a fix. All earlier releases in this range are vulnerable. The vendor is the authors of WeeChat.

The vulnerability carries a CVSS base score of 7.4, indicating high risk. The EPSS score is not available, but the lack of a KEV listing suggests no large‑scale exploitation detected yet. Nevertheless, because the attack requires only network communication with the relay, a remote attacker can launch the timing attack from a network that can reach the relay service. Once the hash is extracted, authentication bypass is trivial. The vulnerability is self‑contained, does not require local privilege or multiple steps, making exploitation straightforward for an adversary who can observe timing.