Category

Timing Attack

Security vulnerabilities and automated fixes for timing attack issues

1 post found

critical4 min

Hybridauth Telegram OAuth Timing Attack in `authenticateCheckError()`

The Telegram OAuth provider in Hybridauth relied on `strcmp()` to validate HMAC-SHA256 signatures, exposing a timing side-channel that could allow attackers to forge authentication tokens character by character. The fix replaces this with PHP's timing-safe `hash_equals()` function, eliminating the information leak.

#authentication#cryptography#timing-attack+5 more
A
anupamme
Oct 2, 2026