CyberRota Analysis
AI-GeneratedThe BasicAuth middleware in Fiber versions prior to 3.3.0 is vulnerable to remote username enumeration due to a flaw in the default Authorizer function, which allows attackers to exploit timing differences in responses when non-existent usernames are queried. This can lead to unauthorized access attempts by revealing valid usernames. Organizations using affected versions should prioritize updating to version 3.3.0 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Fiber is an Express inspired web framework written in Go. Prior to 3.3.0, the default Authorizer function in the BasicAuth middleware in middleware/basicauth/config.go uses short-circuit evaluation that skips password hash comparison for non-existent usernames, enabling reliable remote username enumeration through response timing differences. This issue is fixed in version 3.3.0.
Related CVEs
Other vulnerabilities affecting the same vendor(s)