The default Authorizer function in GoFiber's BasicAuth middleware uses short-circuit evaluation that bypasses password hash verification for unknown usernames. When bcrypt-hashed passwords are used, this results in a timing difference of approximately 1,000,000:1 between valid and invalid usernames due to the expensive bcrypt comparison being skipped for invalid users. This timing discrepancy enables attackers to remotely enumerate valid usernames by measuring response latency. The vulnerability affects versions of github.com/gofiber/fiber/v3 prior to 3.3.0. The recommended fix is to perform a dummy bcrypt hash comparison for unknown usernames to equalize timing, though no patch or vendor advisory is provided in the input data.

Attackers can reliably determine which usernames exist in the system by measuring response times, enabling username enumeration. This facilitates targeted password brute force attacks focused on valid accounts. Additionally, in contexts where usernames are sensitive, such as internal tools or admin panels, this information disclosure is a security concern. The vulnerability does not directly impact password confidentiality or system availability but leaks user existence information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability can be mitigated by modifying the Authorizer to always perform a dummy password hash comparison for unknown usernames to prevent timing differences. Until an official fix is released, users should consider implementing this mitigation in their own code.