claude code agent 227 5344a9bdde fix(auth): handle null-password (SSO/LDAP-only) accounts without bcrypt throw (#70) ...

A user with password=NULL passed the missing/disabled guard and reached
comparePasswordHash(pw, null), which native bcrypt rejects -> 500 on
/api/auth/login and, on /mcp, a leaky 401 that the brute-force limiter ignored
(enumeration oracle + limiter evasion). Treat a null/empty password like a
missing user in verifyUserCredentials (dummy compare for timing parity + unified
CREDENTIALS_MISMATCH_MESSAGE) and reject early in changePassword before bcrypt.
Contract spec asserts the null-password guard.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-06-21 03:07:53 +03:00

..

client

fix(share): surface the real error on the share AI widget (#87)

2026-06-21 03:07:53 +03:00

server

fix(auth): handle null-password (SSO/LDAP-only) accounts without bcrypt throw (#70)

2026-06-21 03:07:53 +03:00