CVE-2026-74035
Wazuh 4.6.0 before 4.14.8 Authentication Bypass via Empty Password in update_user
- State
- Published
- Severity
- 8.6 High
- Published
- Oct 13, 2026
- Updated
- Oct 26, 2026
- Reserved
- Aug 14, 2026
Description
Wazuh versions from 4.6.0 before 4.14.8 contain an authentication bypass vulnerability where security.update_user places the reserved user guard and password policy inside a falsy truthiness check. A delegated user administrator can send an empty password to the user update endpoint, bypassing the reserved user guard to take over the wazuh superuser account and authenticate with empty credentials.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.6 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 7.2 High | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H | VulnCheck |
Weaknesses
- CWE-863 Incorrect Authorization
Affected Products
| Product | Versions |
|---|---|
wazuh-managerWazuh |
|
References
- GitHub Security Advisory (GHSA-27gv-q7q6-f5qh)vendor-advisory
- Wazuh v4.14.8 Release Notespatchrelease-notes
- VulnCheck Advisory: Wazuh 4.6.0 before 4.14.8 Authentication Bypass via Empty Password in update_userthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.