CVE-2026-44332: Fiber: Username Enumeration via Timing Oracle in BasicAuth Default Authorizer
Vulnerability summary
CVE-2026-44332 is a medium (CVSS 5.3) Observable Discrepancy vulnerability in gofiber fiber. EPSS estimates a 0.52% chance of exploitation in the next 30 days, higher than 43.1% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 3 · Related 3Timeline
- 08-07-2026PublishedVulnerability first disclosed.
- 09-07-2026Last modifiedVulnerability information updated.
Description
Fiber is an Express inspired web framework written in Go. Prior to 3.3.0, the default Authorizer function in the BasicAuth middleware in middleware/basicauth/config.go uses short-circuit evaluation that skips password hash comparison for non-existent usernames, enabling reliable remote username enumeration through response timing differences. This issue is fixed in version 3.3.0.
CVSS metrics
4 scores · 4 sources · 1 version- OSV · GoEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- NVDNIST5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- OSV · UbuntuEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS trend
Probability
0.52%
Chance of exploitation in the next 30 days
Percentile
43%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.52% on 22-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundFiber
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Github.com/gofiber/fiber1 product
- v3< 3.3.0
Gofiber1 product
- fiber< 3.3.0
Ubuntu1 product
- golang-github-gofiber-fiberAll versions (No fix recorded)
3 vendors · 3 products
References
7 links- github.com/gofiber/fiber/security/advisories/GHSA-g5vh-55hw-rxm8X Refsource CONFIRMWEBAdvisoryExploitVendor AdvisoryREPORT
- github.com/gofiber/fiberPACKAGE