CVE-2023-25806 - CVE House
Back to Database
Status published Medium CVE-2023-25806

Time discrepancy in authentication responses in OpenSearch

Vulnerability Description

OpenSearch Security is a plugin for OpenSearch that offers encryption, authentication and authorization. There is an observable discrepancy in the authentication response time between calls where the user provided exists and calls where it does not. This issue only affects calls using the internal basic identity provider (IdP), and not other externally configured IdPs. Patches were released in versions 1.3.9 and 2.6.0, there are no workarounds.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-25806

Credits & Attribution

No credits recorded in the NVD database.

References

More from opensearch-project

View All →
CVE-2025-62371
OpenSearch Data Prepper plugins trusts all SSL certificates by default
High 7.4
CVE-2024-55886
OpenTelemetry Logs source may lack authentication with some custom plugins
Medium 6.9
CVE-2024-43794
OpenSearch Dashboards Security Plugin improper validation of nextUrl can lead to external redirect
Medium 6.1
CVE-2024-39901
OpenSearch Observability does not properly restrict access to private tenant resources
Medium 4.2
CVE-2024-39900
OpenSearch Dashboards Reports does not properly restrict access to private tenant resources
Medium 5.4

Affected Vendor

opensearch-project

View all reports →

Affected Software

security
Vulnerable Versions:
< 1.3.9, >= 2.0.0, < 2.6.0

Timeline

Official Publish: March 2nd, 2023
Last Modified: March 5th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weaknesses (CWE)

CWE-208

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.