Static Web Server: Timing-Based Username Enumeration in Basic Authentication
Description
Static Web Server (SWS) is a production-ready web server suitable for static web files or assets. In versions 2.1.0 through 2.40.1, a timing-based username enumeration vulnerability in Basic Authentication allows attackers to identify valid users by exploiting early responses for invalid usernames, enabling targeted brute-force or credential-stuffing attacks. SWS checks whether a username exists before verifying the password, causing valid usernames to follow a slower code path (e.g., bcrypt hashing) while invalid usernames receive an immediate 401 response. This timing discrepancy allows attackers to enumerate valid accounts by measuring response-time differences. This issue has been fixed in version 2.41.0.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
static-web-servercrates.io | >= 2.1.0, < 2.41.0 | 2.41.0 |
Affected products
1- Range: >= 2.1.0, < 2.41.0
Patches
17bf0fd425eb1Merge commit from fork
1 file changed · +6 −12
src/basic_auth.rs+6 −12 modified@@ -74,18 +74,12 @@ pub fn check_request(headers: &HeaderMap, userid: &str, password: &str) -> Resul .typed_get::<Authorization<Basic>>() .ok_or(StatusCode::UNAUTHORIZED)?; - if credentials.0.username() != userid { - return Err(StatusCode::UNAUTHORIZED); - } - - match bcrypt_verify(credentials.0.password(), password) { - Ok(valid) if valid => Ok(()), - Ok(_) => Err(StatusCode::UNAUTHORIZED), - Err(err) => { - tracing::error!("bcrypt password verification error: {:?}", err); - Err(StatusCode::UNAUTHORIZED) - } - } + let user_match = credentials.0.username() == userid; + let password_match = bcrypt_verify(credentials.0.password(), password) + .inspect_err(|err| tracing::error!("bcrypt password verification error: {:?}", err)) + .unwrap_or(false); + let valid = user_match && password_match; + valid.then_some(()).ok_or(StatusCode::UNAUTHORIZED) } #[cfg(test)]
Vulnerability mechanics
Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
4- github.com/advisories/GHSA-qhp6-635j-x7r2ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-27480ghsaADVISORY
- github.com/static-web-server/static-web-server/commit/7bf0fd425eb10dac9bf9ef5febce12c4dd039ce1ghsax_refsource_MISCWEB
- github.com/static-web-server/static-web-server/security/advisories/GHSA-qhp6-635j-x7r2ghsax_refsource_CONFIRMWEB
News mentions
0No linked articles in our index yet.