Admin password brute force via timing leak

Authentication bypass in Nagios XI before 5.9.3 allows remote attackers to brute-force the admin password via insecure ticket timing comparisons. The is_insecure_login_authenticated function compares backend ticket values with a timing-dependent operation that reveals whether successive guesses match. The insecure backend ticket authentication is disabled by default, so exploitation requires that feature to be enabled and the service to be reachable; successful attacks can recover administrator credentials.