title: Prevent timing attack for single-user password check
description: Theoretically, it would be possible for an attacker to brute-force the password for an instance in single-user password protection mode via a timing attack given the linear nature of the `!==` used for comparison.
The risk is minified by the additional overhead of the request, which varies in a non-constant nature making the attack less reliable to execute
problem types: CWE-764 Multiple Locks of a Critical Resource
affected:
{
vendor: mintplex-labs
product: mintplex-labs/anything-llm
versions:
version: unspecified, lessThan: 1.0.0, status: affected, versionType: custom
}
metrics:
cvssV3_0: [
version: 3.0
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
baseScore: 7.1
baseSeverity: HIGH
]