The flaw occurs because Hono's basicAuth and bearerAuth middlewares perform non‑constant‑time string comparisons using timingSafeEqual, a weakness categorized as Timing‑Based Side‑Channel Analysis (CWE‑208). This allows an attacker to detect differences in credential strings by measuring request processing time. By exploiting this timing side channel, an adversary can systematically reveal valid usernames or passwords, effectively compromising authentication controls.

Versions of Hono earlier than 4.11.10 are vulnerable. The issue is present in the Hono framework used in Node.js environments. Any deployment of these affected versions that employs the basicAuth or bearerAuth middleware is at risk.

The vulnerability scores a CVSS of 6.3, indicating a moderate severity. The EPSS score of less than 1 % shows a low current exploitation probability, and the vulnerability is not listed in CISA KEV. Attackers would need to perform precise timing measurements against the authentication endpoints, and it is inferred that this can be done over the network, but generally requires a remote attacker positioned close to the target or with sufficient network access. Given the medium CVSS and the low EPSS, the overall risk is moderate but should be mitigated promptly to prevent credential disclosure.