CVE-2026-44332
Prior to 3.3.0, the default Authorizer function in the BasicAuth middleware in middleware/basicauth/config.go uses short-circuit evaluation that skips password hash comparison for non-existent usernames, enabling reliable remote username enumeration…
Does this matter?
Lower severity and a low EPSS score (0.52%). Track it; it rarely justifies an emergency change on its own.
Description
Fiber is an Express inspired web framework written in Go. Prior to 3.3.0, the default Authorizer function in the BasicAuth middleware in middleware/basicauth/config.go uses short-circuit evaluation that skips password hash comparison for non-existent usernames, enabling reliable remote username enumeration through response timing differences. This issue is fixed in version 3.3.0.
- CVSS 3.1
- 5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- EPSS
- 0.52% probability · 42th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-203
- Affected
- gofiber/fiber
- Source
- security-advisories@github.com
References
- https://github.com/gofiber/fiber/commit/c7ac00edd19f9669b1aebbec6e229658baaa059ePatch
- https://github.com/gofiber/fiber/pull/4245Issue Tracking, Patch
- https://github.com/gofiber/fiber/releases/tag/v3.3.0Release Notes
- https://github.com/gofiber/fiber/security/advisories/GHSA-g5vh-55hw-rxm8Exploit, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.