Hash Validation

How Telegram OAuth hash validation bypass happens in PHP and how to fix it

A critical vulnerability in the Telegram OAuth provider allowed attackers to bypass authentication by submitting fabricated hash values without cryptographic validation. The fix replaces an unsafe string comparison with PHP's constant-time `hash_equals()` function, preventing timing attacks and ensuring all user data parameters are properly validated against the HMAC-SHA256 signature.