CVE-2023-25806— Time discrepancy in authentication responses in OpenSearch
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2023-25806
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Time discrepancy in authentication responses in OpenSearch
Source: NVD (National Vulnerability Database)
Vulnerability Description
OpenSearch Security is a plugin for OpenSearch that offers encryption, authentication and authorization. There is an observable discrepancy in the authentication response time between calls where the user provided exists and calls where it does not. This issue only affects calls using the internal basic identity provider (IdP), and not other externally configured IdPs. Patches were released in versions 1.3.9 and 2.6.0, there are no workarounds.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
通过时间差异性导致的信息暴露
Source: NVD (National Vulnerability Database)
Vulnerability Title
OpenSearch Security 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
OpenSearch Security是一个用于提供加密、身份验证和授权的 OpenSearch 插件。 OpenSearch Security存在安全漏洞，该漏洞源于身份验证不正确。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| opensearch-project | security | < 1.3.9 | - |
II. Public POCs for CVE-2023-25806
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2023-25806
请登录查看更多情报信息。
IV. Related Vulnerabilities
Same product: security
- CVE-2025-64113
Emby Server allows attackers to gain administrative server a - CVE-2023-45807
OpenSearch Issue with tenant read-only permissions - CVE-2023-33193
Emby Server Proxy Header Spoofing Vulnerability - CVE-2023-31141
OpenSearch issue with fine-grained access control during ext - CVE-2023-23612
Issue with whitespace in JWT roles in OpenSearch
Same vendor: opensearch-project
- CVE-2025-62371
OpenSearch Data Prepper plugins trusts all SSL certificates - CVE-2024-55886
OpenTelemetry Logs source may lack authentication with some - CVE-2024-43794
OpenSearch Dashboards Security Plugin improper validation of - CVE-2024-39900
OpenSearch Dashboards Reports does not properly restrict acc - CVE-2024-39901
OpenSearch Observability does not properly restrict access t
Same weakness: CWE-208
- CVE-2026-41588
RELATE: Timing Attack Vulnerability in course/auth.py — chec - CVE-2026-41161
Username Enumeration via Timing Attack - CVE-2026-33006
Apache HTTP Server: mod_auth_digest timing attack - CVE-2026-41263
Traefik: BasicAuth middleware: timing side-channel vulnerabi - CVE-2026-41407
OpenClaw < 2026.4.2 - Timing Side Channel in Shared-Secret C
V. Comments for CVE-2023-25806
No comments yet