Executive brief
@perfood/couch-auth is an authentication library used to protect access to CouchDB instances. An observable timing discrepancy in the authentication logic allows attackers to use side-channel attacks to guess sensitive tokens, potentially bypassing authentication and gaining unauthorized access to protected databases.
Technical details
The vulnerability is a timing side-channel attack (CWE-208) in @perfood/couch-auth v0.26.0 that allows attackers to infer sensitive authentication tokens through observable differences in response times. The authentication logic does not use constant-time comparison functions when validating tokens, making it possible for a remote attacker over a network to measure timing variations and progressively guess valid tokens. No user interaction or authentication is required to exploit this vulnerability. An attacker can leverage these timing differences to bypass authentication mechanisms and gain unauthorized access. A patch should implement constant-time token comparison to mitigate this issue.
Affected products
- perfood @perfood/couch-auth 0.26.0 and earlier
Timeline
- 2026-03-05: disclosed
- 2026-03-05: advisory