CVE-2026-44332

MediumCVSS 5.3/10Last modified Oct 25, 2026

Description

Fiber is an Express inspired web framework written in Go. Prior to 3.3.0, the default Authorizer function in the BasicAuth middleware in middleware/basicauth/config.go uses short-circuit evaluation that skips password hash comparison for non-existent usernames, enabling reliable remote username enumeration through response timing differences. This issue is fixed in version 3.3.0.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-203

Affected software

Vendor	Product	Versions
gofiber	fiber	< 3.3.0

References

https://github.com/gofiber/fiber/commit/c7ac00edd19f9669b1aebbec6e229658baaa059ePatch
https://github.com/gofiber/fiber/pull/4245Issue Tracking, Patch
https://github.com/gofiber/fiber/releases/tag/v3.3.0Release Notes
https://github.com/gofiber/fiber/security/advisories/GHSA-g5vh-55hw-rxm8Exploit, Vendor Advisory

Timeline

Published: Jul 8, 2026
Last modified: Oct 25, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-443348.4PraisonAI is a multi-agent teams system. From version 4.5.139 to before version 4.6.32, CVE-2026-40287's fix gated tools.py auto-import behi CVE-2026-443359.8PraisonAI is a multi-agent teams system. Prior to version 1.6.32, the URL checking logic in PraisonAI has a logical flaw that could be bypas CVE-2026-443369.6PraisonAI is a multi-agent teams system. Prior to version 4.6.34, PraisonAI's MCP (Model Context Protocol) server (praisonai mcp serve) regi CVE-2026-443376.3PraisonAI is a multi-agent teams system. From version 2.4.1 to before version 4.6.34, PraisonAI exposes optional SQL/CQL-backed knowledge-st CVE-2026-443387.3PraisonAI is a multi-agent teams system. From version 2.5.6 to before version 4.6.34, PraisonAI ships a legacy Flask API server with authent CVE-2026-443398.6PraisonAI is a multi-agent teams system. Prior to praisonai version 4.6.37 and praisonaiagents version 1.6.37, praisonaiagents resolves unre CVE-2026-44348.1Improper certificate validation in the PAM propagation WinRM connections allows a network attacker to perform a man-in-the-middle attack vi CVE-2026-443407.5PraisonAI is a multi-agent teams system. Prior to version 4.6.37, the _safe_extractall helper that all recipe pull, recipe publish, and reci CVE-2026-443415.3GoJobs is a REST API for a Job Board platform. The application exposes a job retrieval endpoint that allows unauthenticated users to access CVE-2026-443425.3New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 0.12.0-alpha.1, the email CVE-2026-443439.8WGDashboard is a dashboard for WireGuard VPN. Prior to 4.3.2, there are critical vulnerabilities affecting WGDashboard that, if exploited, c CVE-2026-443446.6Chamilo LMS is an open-source learning management system. In the 1.x line before 1.11.40, and the 2.x line before 2.0.1, multiple `eval()` c