-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe analysis of the patch commit 4d9b5d3d6486ab9fbd5b644173fa0097015d6626 clearly indicates that the timing side-channel vulnerability in the userpass authentication method was fixed in the backend.pathLogin function located in builtin/credential/userpass/path_login.go. The vulnerability was caused by differential handling of login requests for existing and non-existing users. The patch introduces two key changes to normalize the time taken for these two scenarios. First, it bypasses the storage cache using physical.CacheRefreshContext to ensure user lookups always hit the physical backend, equalizing I/O time. Second, for non-existent users, instead of creating a dummy password string on the fly, it uses a pre-computed bcrypt hash (dummyHash). This ensures the cryptographic comparison step takes a constant amount of time, regardless of whether the username exists. The vulnerable function, backend.pathLogin, is the direct handler for the login/<username> path and contained this flawed logic.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/openbao/openbao | go | >= 0.1.0, < 2.3.2 | 2.3.2 |
| github.com/openbao/openbao | go | < 0.0.0-20250806193356-4d9b5d3d6486 | 0.0.0-20250806193356-4d9b5d3d6486 |
GoGoOngoing coverage of React2Shell