CVE-2026-53525 WeeChat has Non-Constant-Time Password Hash Comparison in Relay Authentication
Attackers can bypass relay authentication in WeeChat by exploiting timing side-channels in password hash comparison to extract hashes and gain access.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-53525?
CVE-2026-53525 is a high-severity vulnerability in weechat, published on 21 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
WeeChat (Wee Enhanced Environment for Chat) is a free chat client. In versions 0.3.1 through 4.9.0, the WeeChat relay authentication uses non-constant-time string comparison functions (weechat_strcasecmp and strcmp) to verify password hashes and plaintext passwords. An attacker can exploit timing differences to extract the server-computed hash character by character, then authenticate using the correct hash without knowing the password. Version 4.9.1 fixes the issue.
Weakness: CWE-208
Which versions are affected by CVE-2026-53525?
How do I fix CVE-2026-53525?
Upgrade to a fixed version.
Is CVE-2026-53525 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-53525 exists.
Sources
Also known as DEBIAN-CVE-2026-53525, GHSA-vhv8-g2r9-cwcc, UBUNTU-CVE-2026-53525.