Login Response Times Can Reveal User Account Existence to Attackers

Security researchers highlight a timing side-channel vulnerability in login endpoints where response time differences can expose whether an account exists, even when error messages are identical. When a user email is not found, the server responds almost instantly, but a valid email triggers an additional slow password-hashing step using algorithms like bcrypt or Argon2, creating a measurable delay of 50–200ms. Attackers can exploit this gap by submitting candidate emails and timing responses, allowing large-scale account enumeration without triggering unusual error logs. A dummy hash comparison partially mitigates the issue but does not fully eliminate the statistical timing difference. The recommended fix is to enforce a minimum response floor time across all login code paths, ensuring every request takes at least a fixed duration regardless of which internal branch executed.