Executive brief
WeeChat is a free chat client that supports remote relay connections for accessing chat sessions over a network. The relay authentication mechanism uses non-constant-time string comparison functions to verify password hashes, allowing an attacker to extract the server's password hash character by character through timing analysis, then authenticate without knowing the original password. This effectively bypasses authentication security on any WeeChat relay server.
Technical details
The vulnerability is a timing attack (CWE-208) in the relay authentication layer where password hashes and plaintext passwords are verified using standard string comparison functions (weechat_strcasecmp and strcmp) instead of constant-time comparison. These functions exit early on the first mismatch, creating measurable timing differences that leak information about correct vs. incorrect hash characters. An attacker can send authentication attempts with incrementally modified hashes, measuring response times to deduce the correct hash one character at a time. Over a network or LAN with sufficient statistical analysis, or especially on localhost, an attacker can recover the full 64-character SHA-256 hash (~1024 attempts) and then authenticate using that hash. The vulnerability affects versions 0.3.1 through 4.9.0 and is patched in version 4.9.1 with constant-time comparison functions.
Affected products
- WeeChat WeeChat 0.3.1 through 4.9.0
Timeline
- 2026-05-31: disclosed: GitHub security advisory GHSA-vhv8-g2r9-cwcc published
- 2026-08-21: disclosed: CVE-2026-53525 published on NVD
- 2026-05-31: patched: Fixed in version 4.9.1