CVE-2026-53525
HighCVSS 7.4Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
WeeChat versions 0.3.1 through 4.9.0 use non-constant-time string comparison functions (weechat_strcasecmp and strcmp) to verify password hashes and plaintext passwords in relay authentication. An attacker can exploit timing differences to extract the server-computed hash character by character, then authenticate without knowing the password. Version 4.9.1 fixes the issue.
Risk Assessment
An attacker could compromise user accounts or gain unauthorized access to relay functionality, potentially leading to data confidentiality and integrity breaches.
Recommendation
Upgrade WeeChat to version 4.9.1 or later to mitigate the timing attack vulnerability.
Other vulnerabilities in WeeChat
See all- CVE-2017-8073High
WeeChat before 1.7.1 allows a remote crash by sending a filename via DCC to the IRC plugin. This occurs in the irc_ctcp_dcc_filename_without_quotes function during quote removal, leading to a buffer overflow.
- CVE-2026-53524Medium
WeeChat versions 4.3.0 through 4.9.0 have a vulnerability in the WebSocket permessage-deflate decompression function relay_websocket_inflate() in the relay module, which has no upper bound on output size. An authenticated relay user can send a small compressed WebSocket frame (~100 bytes) that decompresses to gigabytes, exhausting all server memory and crashing the entire WeeChat process.
Original NVD description (English source)
WeeChat (Wee Enhanced Environment for Chat) is a free chat client. In versions 0.3.1 through 4.9.0, the WeeChat relay authentication uses non-constant-time string comparison functions (weechat_strcasecmp and strcmp) to verify password hashes and plaintext passwords. An attacker can exploit timing differences to extract the server-computed hash character by character, then authenticate using the correct hash without knowing the password. Version 4.9.1 fixes the issue.