CVE-2026-41571: Go Bcrypt Empty Password Placeholder Auth Bypasscve-2026-41571-go-bcrypt-empty-password-placeholder-auth-bypass
Authentication function compares the supplied plaintext against a placeholder bcrypt hash when the user's stored password is empty (a CWE-208 timing-attack mitigation), but the success guard only checks `err == nil` without also requiring that the stored password is non-empty. An unauthenticated attacker who submits the plaintext that matches the placeholder
