Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability is a classic timing side-channel attack in the authentication process. The root cause is the non-constant time execution of the auth.JSONAuth.Auth function. In the vulnerable version, the code first fetches the user from the database. If the user is not found, it returns an error right away. If the user is found, it then proceeds to call users.CheckPwd to compare the provided password with the stored hash using bcrypt, which is an intentionally slow operation. This difference in execution paths—an immediate return for an invalid user versus a delayed return for a valid user (even with a wrong password)—allows an attacker to measure the server's response time to distinguish between valid and invalid usernames.
The patch addresses this by refactoring the logic to ensure the execution time is consistent regardless of whether the username exists. It achieves this by always performing a password check. If the user does not exist, it compares the provided password against a pre-generated invalid password hash. This ensures that the expensive bcrypt comparison is performed in both scenarios, making the response times for valid and invalid usernames statistically indistinguishable and thus mitigating the timing attack.
auth.JSONAuth.Authbackend/auth/json.go
users.CheckPwdbackend/database/users/password.go
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/gtsteffaniak/filebrowser/backend | go | < 0.0.0-20260317230626-af08800667b8 | 0.0.0-20260317230626-af08800667b8 |