CVE-2026-53525: WeeChat has Non-Constant-Time Password Hash Comparison in Relay Authentication

Severity: high (CVSS 7.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-21 · updated 2026-10-14
Weakness: CWE-208

Description

WeeChat (Wee Enhanced Environment for Chat) is a free chat client. In versions 0.3.1 through 4.9.0, the WeeChat relay authentication uses non-constant-time string comparison functions (weechat_strcasecmp and strcmp) to verify password hashes and plaintext passwords. An attacker can exploit timing differences to extract the server-computed hash character by character, then authenticate using the correct hash without knowing the password. Version 4.9.1 fixes the issue.

Affected products

weechat: from 0.3.4, < 4.9.1

References

https://github.com/weechat/weechat/security/advisories/GHSA-vhv8-g2r9-cwcc
https://github.com/weechat/weechat/security/advisories/GHSA-vhv8-g2r9-cwcc

Get alerted when CVE-2026-53525 or the next vulnerability affects your stack