LOW: Login rate limiter bypassed when no users exist (first-run timing window) #83

New Issue

Open

opened 2026-05-31 12:04:08 -05:00 by null · 0 comments

null commented

2026-05-31 12:04:08 -05:00

Owner

Bug Description

server.js:46-60 implements skipRateLimitIfNoUsers() which queries the DB on every login request when no session exists. This means:

A timing side-channel reveals whether any users exist (different response times)
During the window when no users exist, the login endpoint has zero rate limiting, enabling rapid brute-force attempts against the first admin account creation

Impact

Minimal in practice - the window is only during initial setup. But the timing leak could be used to fingerprint whether the app has been set up.

Recommended Fix

Consider a fixed-rate limit even for the no-users state (e.g., 20 requests/15min) that allows legitimate setup while preventing abuse.

## Bug Description server.js:46-60 implements skipRateLimitIfNoUsers() which queries the DB on every login request when no session exists. This means: 1. A timing side-channel reveals whether any users exist (different response times) 2. During the window when no users exist, the login endpoint has zero rate limiting, enabling rapid brute-force attempts against the first admin account creation ## Impact Minimal in practice - the window is only during initial setup. But the timing leak could be used to fingerprint whether the app has been set up. ## Recommended Fix Consider a fixed-rate limit even for the no-users state (e.g., 20 requests/15min) that allows legitimate setup while preventing abuse.