starred/audiobookshelf
1
0
Fork 0
mirror of https://github.com/advplyr/audiobookshelf.git synced 2026-05-30 23:40:40 +02:00
Code Issues 1.0k Packages Projects Releases 10 Wiki Activity

[Bug]: Moved #2794

New Issue
Closed
opened 2026-04-25 00:10:44 +02:00 by adam · 0 comments
adam commented 2026-04-25 00:10:44 +02:00
Owner
Copy Link
Copy Source

Originally created by @Foyerr on GitHub (May 23, 2025).

What happened?

I noticed that when hitting the authentication endpoint, there's a consistent difference in response time between valid and invalid usernames. This can be used to enumerate which usernames exist in the system.

I tested this by sending 100 requests per username and taking the median response time. Here’s a sample of the results (usernames have been anonymized):

Username MedianTimeMS

User1 25.69
User2 24.28
root 22.50
User3 22.26
john 5.13
guest 5.11
eric 5.10
admin 5.08
jane 5.08

As you can see, the first few usernames consistently take longer to respond, which suggests they're valid accounts. The rest respond much faster, because they don't exist.

This doesn’t apply to passwords, bcrypt appears to be in use, which handles comparison securely with a constant time comparison.

Might be worth taking a look to ensure the response timing is consistent regardless of whether the username exists, to prevent this kind of side-channel info leak.

What did you expect to happen?

Expect that the timing between nonvalid usernames and valid usernames to take the same amount of time as to not leak data.

Steps to reproduce the issue

https://github.com/Foyerr/Check-UsernamesAudiobookshelf
I have created a powershell script to demonstrate
provide the ip/hostname and a username if you wish, the script has a handful of test usernames including root

Audiobookshelf version

v2.16.2

How are you running audiobookshelf?

Windows Tray App

What OS is your Audiobookshelf server hosted from?

Windows

If the issue is being seen in the UI, what browsers are you seeing the problem on?

None

Logs

Additional Notes

No response

Originally created by @Foyerr on GitHub (May 23, 2025). ### What happened? I noticed that when hitting the authentication endpoint, there's a consistent difference in response time between valid and invalid usernames. This can be used to enumerate which usernames exist in the system. I tested this by sending 100 requests per username and taking the median response time. Here’s a sample of the results (usernames have been anonymized): Username MedianTimeMS --------- ------------- User1 25.69 User2 24.28 root 22.50 User3 22.26 john 5.13 guest 5.11 eric 5.10 admin 5.08 jane 5.08 As you can see, the first few usernames consistently take longer to respond, which suggests they're valid accounts. The rest respond much faster, because they don't exist. This doesn’t apply to passwords, bcrypt appears to be in use, which handles comparison securely with a constant time comparison. Might be worth taking a look to ensure the response timing is consistent regardless of whether the username exists, to prevent this kind of side-channel info leak. ### What did you expect to happen? Expect that the timing between nonvalid usernames and valid usernames to take the same amount of time as to not leak data. ### Steps to reproduce the issue https://github.com/Foyerr/Check-UsernamesAudiobookshelf I have created a powershell script to demonstrate provide the ip/hostname and a username if you wish, the script has a handful of test usernames including root ### Audiobookshelf version v2.16.2 ### How are you running audiobookshelf? Windows Tray App ### What OS is your Audiobookshelf server hosted from? Windows ### If the issue is being seen in the UI, what browsers are you seeing the problem on? None ### Logs ```shell ``` ### Additional Notes _No response_
adam added the bug label 2026-04-25 00:10:44 +02:00
adam closed this issue 2026-04-25 00:10:45 +02:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
authentication
backlog
bug
chapter editor
config-issue
ebooks
encoding/embedding
enhancement
help wanted
listening sessions & progress
planned
possible plugin
progress sync
pull-request
Mirrored from GitHub Pull Request
 sorting/filtering/searching
unable to reproduce
upload
users & permissions
waiting
No Label bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam (Adam Melkus)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/audiobookshelf#2794
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?