Remote Username Enumeration in Fiber Web Framework by Go

CVE-2026-44332

What is CVE-2026-44332?

The Fiber web framework, a Go-based Express-like framework, prior to version 3.3.0, possesses a flaw in its BasicAuth middleware. This vulnerability allows attackers to exploit the short-circuit evaluation in the default Authorizer function, which skips the password hash comparison for non-existing usernames. Consequently, this behavior can lead to reliable remote username enumeration through varying response times, thereby allowing malicious actors to identify valid usernames within the application.

References