fix: prevent user enumeration using local login timings

server/modules/authentication/local/authentication.js

+const bcrypt = require('bcryptjs-then')
+
 /* global WIKI */
 
 // ------------------------------------
@@ -28,6 +30,9 @@ module.exports = {
               done(null, user)
             }
           } else {
+            // Fake verify password to mask timing differences
+            await bcrypt.compare((Math.random() + 1).toString(36), '$2a$12$irXbAcQSY59pcQQfNQpY8uyhfSw48nzDikAmr60drI501nR.PuBx2')
+
             done(new WIKI.Error.AuthLoginFailed(), null)
           }
         } catch (err) {