WeeChat relay auth uses non-constant-time string comparison
WeeChat versions 0.3.1–4.9.0 verify relay passwords with non-constant-time functions, enabling timing side-channel attacks that recover auth hashes without the underlying password. Fixed in 4.9.1.
- Vendor
- WeeChat
- Product
- WeeChat
- CVSS
- 7.4
- EPSS (exploit probability)
- 0.4%
- Status
- patched
- Published
WeeChat’s relay module — which allows external clients to connect to a running instance over a network — verifies credentials using weechat_strcasecmp and strcmp. Both functions return early on a mismatch, producing measurable timing differences. A remote attacker can exploit those differences to recover the server-computed password hash character by character, then authenticate using the extracted hash without knowing the original password.
The flaw affects all versions from 0.3.1 through 4.9.0. WeeChat 4.9.1 replaces the affected comparisons with constant-time equivalents.
Relay mode is off by default. Exposure is highest for operators running relay on an internet-facing port without a VPN or SSH tunnel.
No active exploitation reported. Responsibly disclosed via GitHub Security Advisories.
