From 7f7da7f5836f5e65c59787937efcc087303947db Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Andr=C3=A9=20Duffeck?= <a.duffeck@opencloud.eu>
Date: Tue, 6 Oct 2026 08:37:00 +0200
Subject: [PATCH] Use subtle to compare the hash

---
 services/auth-guest/pkg/service/token/token.go | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/services/auth-guest/pkg/service/token/token.go b/services/auth-guest/pkg/service/token/token.go
index e997845a62..5f0a240265 100644
--- a/services/auth-guest/pkg/service/token/token.go
+++ b/services/auth-guest/pkg/service/token/token.go
@@ -6,6 +6,7 @@ package token
 import (
 	"crypto/rand"
 	"crypto/sha256"
+	"crypto/subtle"
 	"encoding/base64"
 	"errors"
 	"fmt"
@@ -65,7 +66,8 @@ func (s *TokenService) Parse(encoded string) (*Token, error) {
 }
 
 func (s *TokenService) Verify(candidate Token, storedSecretHash string) error {
-	if candidate.ShareIDHash == "" || candidate.secret == "" || candidate.SecretHash() != storedSecretHash {
+	if candidate.ShareIDHash == "" || candidate.secret == "" ||
+		subtle.ConstantTimeCompare([]byte(candidate.SecretHash()), []byte(storedSecretHash)) != 1 {
 		return ErrInvalidToken
 	}