Fiber is an Express inspired web framework written in Go. Prior to 3.3.0, the default Authorizer function in the BasicAuth middleware in middleware/basicauth/config.go uses short-circuit evaluation that skips password hash comparison for non-existent usernames, enabling reliable remote username enumeration through response timing differences. This issue is fixed in version 3.3.0.

Affected: Go: github.com/gofiber/fiber/v3

## Summary

The default `Authorizer` function in GoFiber's BasicAuth middleware uses short-circuit evaluation that skips password hash comparison for non-existent usernames. With bcrypt-hashed passwords (the primary use case), the timing difference between a valid and invalid username is approximately 1,000,000:1 (~100ms vs ~100ns), enabling reliable remote username enumeration.

## Vulnerable Code

**File:** `middleware/basicauth/config.go`, lines 126-138

```go if cfg.Authorizer == nil { verifiers := make(map[string]func(string) bool, len(cfg.Users)) for u, hpw := range cfg.Users { v, err := parseHashedPassword(hpw) if err != nil { panic(err) } verifiers[u] = v } cfg.Authorizer = func(user, pass string, _ fiber.Ctx) bool { verify, ok := verifiers[user] return ok && verify(pass) // line 137: short-circuit skips verify() if user unknown } } ```

## Data Flow

1. Attacker sends `Authorization: Basic <base64(candidate:wrongpass)>` 2. BasicAuth middleware decodes credentials and calls `cfg.Authorizer(user, pass, c)` 3. Map lookup `verifiers[user]` returns `ok=false` for non-existent users 4. Go `&&` short-circuit: `false && verify(pass)` returns immediately without calling `verify()` 5. For valid users, `verify(pass)` executes `bcrypt.CompareHashAndPassword()` (line 167: ~100ms at default cost 10) 6. Timing difference: ~100ns (invalid user) vs ~100ms (valid user) = 1,000,000:1 ratio

**Timing comp…