GHSA-53hj-r94p-8c8f: Kanidm has non-constant-time comparison of OAuth2 client_secret

May 6, 2026

The kanidmd OAuth2 token-exchange (/oauth2/token) and token-introspection (/oauth2/token/introspect) endpoints compare the supplied client_secret against the stored secret using Rust’s PartialEq on String, which short-circuits on the first mismatching byte. This produces an observable timing discrepancy that varies with the length of the matching prefix.

References

github.com/advisories/GHSA-53hj-r94p-8c8f
github.com/kanidm/kanidm/security/advisories/GHSA-53hj-r94p-8c8f

Code Behaviors & Features

Detect and mitigate GHSA-53hj-r94p-8c8f with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →