CVE-2026-53525: Weechat

High severity, CVSS 7.4. EPSS: 0.4% chance of exploitation in the next 30 days.

WeeChat (Wee Enhanced Environment for Chat) is a free chat client. In versions 0.3.1 through 4.9.0, the WeeChat relay authentication uses non-constant-time string comparison functions (weechat_strcasecmp and strcmp) to verify password hashes and plaintext passwords. An attacker can exploit timing differences to extract the server-computed hash character by character, then authenticate using the correct hash without knowing the password. Version 4.9.1 fixes the issue.

Affected products

• Weechat Weechat: from 0.3.4, before 4.9.1 (fixed in 4.9.1)

Published 2026-08-21. Last modified 2026-09-09.