The vulnerability in GoFiber's BasicAuth middleware default Authorizer arises from a timing oracle that enables attackers to distinguish valid usernames by observing response time differences. Specifically, for non-existent usernames, the Authorizer bypasses bcrypt password hash verification, resulting in a much faster response (~100ns) compared to the slower bcrypt verification (~100ms) for existing usernames. This timing discrepancy allows reliable username enumeration remotely. The issue affects GoFiber versions before 3.3.0. No official patch or remediation information is provided in the available data.

This vulnerability allows remote attackers to enumerate valid usernames by exploiting timing differences in authentication responses. Username enumeration can aid attackers in focusing brute force or credential stuffing attacks on valid accounts, increasing the risk of unauthorized access. The vulnerability does not directly impact password confidentiality or system availability but leaks sensitive information about account existence.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider implementing custom Authorizer logic that performs consistent-time password hash verification regardless of username validity to mitigate timing discrepancies.