CVE-2021-43298

CVE-2021-43298 is a critical vulnerability affecting Embedthis GoAhead web servers, allowing unauthenticated attackers to bypass HTTP Basic Authentication. The flaw stems from a non-constant-time password comparison function and lack of rate-limiting, enabling byte-by-byte brute-forcing of credentials by observing response times. With a CVSS score of 9.8, it presents a high risk of complete compromise (confidentiality, integrity, and availability) due to its network-based, low-complexity attack vector. While there is no known active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered significant community discussion, indicating awareness and potential for future exploitation.