CyberRota Analysis
AI-GeneratedWeeChat versions 0.3.1 through 4.9.0 are vulnerable due to their use of non-constant-time string comparison functions for relay authentication, allowing attackers to exploit timing discrepancies to recover password hashes character by character. This vulnerability poses a high risk, as it enables unauthorized authentication without knowledge of the actual password. Organizations using affected versions should prioritize upgrading to version 4.9.1 to mitigate this security risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
WeeChat (Wee Enhanced Environment for Chat) is a free chat client. In versions 0.3.1 through 4.9.0, the WeeChat relay authentication uses non-constant-time string comparison functions (weechat_strcasecmp and strcmp) to verify password hashes and plaintext passwords. An attacker can exploit timing differences to extract the server-computed hash character by character, then authenticate using the correct hash without knowing the password. Version 4.9.1 fixes the issue.