CVE-2026-44332 Details

A vulnerability in the GoFiber web framework's BasicAuth middleware prior to version 3.3.0 allows for remote username enumeration. The default Authorizer function uses short-circuit evaluation, skipping password hash comparisons for non-existent usernames. This creates a timing discrepancy that can be exploited to determine valid usernames. The issue arises because, for valid usernames, the password verification process takes significantly longer than for invalid ones, enabling attackers to infer the existence of usernames based on response times.

Users can upgrade to GoFiber version 3.3.0 or later, where this vulnerability has been fixed. The updated version ensures that the Authorizer function always performs a dummy password verification for unknown usernames, eliminating the timing discrepancy that allowed for username enumeration.