Sync-in Server has Username/Login Enumeration via Timing Side-Channel on POST /api/auth/login (incomplete fix of the prior timing-attack advisory)

validateUser() in backend/src/authentication/providers/mysql/auth-provider-mysql.service.ts returns immediately when the supplied login/email does not match any account, without ever calling comparePassword():

 1async validateUser(loginOrEmail: string, password: string, ip?: string, scope?: AUTH_SCOPE): Promise<UserModel> {
 2  let user: UserModel
 3  try {
 4    user = await this.usersManager.findUser(loginOrEmail, false)
 5  } catch (e) { ... }
 6  if (!user) {
 7    this.logger.warn(...)
 8    return null   // <-- comparePassword() is never reached here
 9  }
10  return await this.usersManager.logUser(user, password, ip, scope)
11}

comparePassword() (backend/src/common/functions.ts) already contains a dummy-hash branch that was clearly added to defend against exactly this class of attack:

 1export async function comparePassword(password: string, hash?: string | null): Promise<boolean> {
 2  if (!hash) {
 3    // No hash, waste time for time-based attacks
 4    await bcrypt.compare(password, DUMMY_PASSWORD_HASH)
 5    return false
 6  }
 7  return await bcrypt.compare(password, hash)
 8}

The problem is that this protection only runs when comparePassword() is actually invoked with a falsy hash. Because validateUser() short-circuits with return null as soon as findUser() comes back empty, the "account doesn't exist" path skips all cryptographic work entirely, while the "account exists, wrong password" path always performs a real bcrypt comparison (cost factor 10, ~100ms+). The two outcomes are trivially distinguishable by response time.

There's already a published advisory in this repo for "Username Enumeration via Timing Attack" - this looks like the same underlying issue surfacing through a different call path (the early return in validateUser()) that the existing fix (the dummy-hash branch in comparePassword()) doesn't actually reach, rather than a brand new vulnerability class.

Any unauthenticated client can determine whether a given username/email is a valid account on the instance by timing POST /api/auth/login:

• Non-existent login: near-instant rejection (no bcrypt call).
• Existing login (regardless of password correctness): consistently slower due to a real bcrypt comparison.

This enables efficient enumeration of valid accounts, which can then be used to focus credential-stuffing, password-spraying, or phishing against confirmed-valid targets.

Verified with the actual comparePassword() logic and the real DUMMY_PASSWORD_HASH constant copied verbatim from backend/src/common/functions.ts, using the project's own bcryptjs dependency (no mocking of bcrypt itself):

 1Avg time for "login does not exist" path (validateUser returns null, no bcrypt call): 0.00 ms
 2Avg time for "login exists, wrong password" path (real bcrypt.compare runs):          114.90 ms
 3Difference: 114.90 ms (ratio: ~58923x)

The "not found" path reproduces validateUser()'s exact early return (no call into comparePassword); the "wrong password" path reproduces logUser()'s real call into comparePassword(password, user.password). The gap is large enough to be trivially observable over a real network, even accounting for jitter.

Reachable endpoint: POST /api/auth/login, guarded only by AuthLocalGuard (Passport local strategy invoking validateUser()), no authentication required.

Make validateUser() always pass through comparePassword()'s timing-equalized path, even when no user is found, e.g.:

 1if (!user) {
 2  await comparePassword(password, null) // burns the same time as a real comparison
 3  return null
 4}

so the "account not found" and "account found, wrong password" branches take statistically indistinguishable time.