CVE-2025-57784

Tomahawk auth timing attack due to usage of `strcmp` has been identified in Hiawatha webserver version 11.7 which allows a local attacker to access the management client.

Score

CVSS 3.1 4.0 Medium

Status

Analyzed - cret@cert.org

Published

2026-01-26

Last modified

2026-01-26

Affected products

• Hiawatha Web Server (Hiawatha)
• Hiawatha (Hiawatha-webserver)

References

• https://gitlab.com/hsleisink/hiawatha/-/blame/master/src/tomahawk.c?ref_type=heads#L429