The BasicAuth middleware in the GoFiber framework performs a short‑circuit check that skips password hash comparison when a username is absent. This logic introduces a measurable timing difference between authentication attempts for valid and invalid usernames, enabling a remote attacker to enumerate existing accounts. The weakness is a timing oracle and is classified as CWE‑203. Because the vulnerability does not grant code execution or direct data disclosure, its impact is limited to the discovery of valid usernames, which can aid subsequent credential‑guessing or social‑The CVSS score of 5.3 indicates moderate risk, reflecting the enumeration capability without direct control over the host. The EPSS score of less than 1% signals the wild, yet enumeration can be carried out from a remote location by sending crafted HTTP requests latency. The vulnerability is not listed in the CISA KEV catalog, meaning no publicly documented active exploits are known at present.

All applications built with the GoFiber framework prior to version 3.3.0 are affected. The default BasicAuth authorizer contains the vulnerable logic until the library is upgraded to v3 which point constant‑time checks are applied. The issue applies to all releases of the gofiber:fiber product before that milestone.

The CVSS score of 5.3 describes a moderate impact focused on confidentiality, as the flaw permits enumeration of valid usernames but not direct code execution or data exfiltration. The EPSS score of less than 1% indicates that such attacks are currently rare in the wild, and the vulnerability is not listed in the CISA KEV catalog, implying no known active exploitation. The attack vector is inferred to be remote, using HTTP requests to the BasicAuth endpoint over the network; a timing oracle can be exploited without authentication headers to deduce account existence by measuring response latency. The exploit timed requests and interpreting differences, making it relatively straightforward but still non‑trivial, as network noise can obscure timing variations. For organizations using GoFiber, the risk is a potential precursor to credential‑guessing attacks if valid usernames are obtained, so timely mitigation is advisable.