Executive brief
Fiber is a popular web framework for the Go programming language used to build high-performance web applications. A flaw in its built-in authentication component allows attackers to determine which usernames are valid on a system by measuring how long the server takes to respond to login attempts. This information can be used to conduct more targeted and effective password-guessing attacks or to discover sensitive account names.
Technical details
The default Authorizer function in Fiber's BasicAuth middleware (middleware/basicauth/config.go) utilizes short-circuit evaluation when verifying credentials. If a provided username does not exist in the configuration map, the function returns immediately without performing a password hash comparison. When using computationally expensive hashes like bcrypt, this creates a significant timing difference (approximately 100ms for valid users vs 100ns for invalid users). An attacker can exploit this timing oracle to reliably enumerate valid usernames via network requests. The vulnerability was addressed in version 3.3.0 by ensuring a dummy hash comparison is performed even when a username is not found.
Affected products
- gofiber Fiber < 3.3.0
Timeline
- 2026-04-29: other: Pull request to fix the timing oracle submitted
- 2026-05-22: patched: Version 3.3.0 released
- 2026-07-02: advisory: GitHub Security Advisory published
- 2026-07-08: disclosed: CVE-2026-44332 published to NVD