CVE-2023-25806: 
Java vulnerability analysis and mitigation

OpenSearch Security, a plugin for OpenSearch that provides encryption, authentication, and authorization capabilities, was found to contain a timing discrepancy vulnerability (CVE-2023-25806) in February 2023. The vulnerability affects versions <1.3.9 and <2.6.0 of the OpenSearch Security plugin (GitHub Advisory).

The vulnerability is classified as CWE-208 (Information Exposure Through Timing Discrepancy) and has been assigned a CVSS v3.0 score of 5.3 (Moderate). The attack vector is Network-based, with low attack complexity, requiring no privileges or user interaction. The vulnerability maintains an unchanged scope, with potential low impact on confidentiality and no impact on integrity or availability (GitHub Advisory).

The vulnerability exposes a timing discrepancy in authentication response times between existing and non-existing user accounts when using the internal basic identity provider (IdP). This issue specifically affects calls using the internal basic IdP and does not impact externally configured IdPs (GitHub Advisory).

The vulnerability has been patched in OpenSearch versions 1.3.9 and 2.6.0. No workarounds are available, and users are advised to upgrade to the patched versions (GitHub Advisory).