userpassword.Compare() substituted a placeholder hash derived from the well-known string "hunter2" when the stored hash was empty. Submitting "hunter2" therefore matched accounts with no password hash (nonexistent users and SSO-only users) and a subsequent login-type check returned an HTTP 403 that disclosed the account's login type, versus 401 for password users.

An unauthenticated attacker could enumerate valid accounts and their authentication provider by submitting logins with the password "hunter2", distinguishing nonexistent users, SSO users (provider revealed) and password users from the response. This aids credential-stuffing and targeted phishing. No authentication bypass or data access resulted.

The fix derives the timing-defense placeholder from a secure random value that no supplied password can match.

The fix was backported to all supported release lines:

None.

We'd like to thank Anthropic's Security Team (ANT-2026-22433) for independently disclosing this issue!