From 69b3ec35116eb279ae9cab35ac30a0546161f974 Mon Sep 17 00:00:00 2001
From: Classic298 <27028174+Classic298@users.noreply.github.com>
Date: Sat, 11 Apr 2026 22:57:47 +0200
Subject: [PATCH] scim: use hmac.compare_digest for bearer token check (#23577)

---
 backend/open_webui/routers/scim.py | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/backend/open_webui/routers/scim.py b/backend/open_webui/routers/scim.py
index 56923bc44..7bc0157b1 100644
--- a/backend/open_webui/routers/scim.py
+++ b/backend/open_webui/routers/scim.py
@@ -5,6 +5,7 @@ Provides System for Cross-domain Identity Management endpoints for users and gro
 NOTE: This is an experimental implementation and may not fully comply with SCIM 2.0 standards, and is subject to change.
 """
 
+import hmac
 import logging
 import uuid
 import time
@@ -278,7 +279,7 @@ def get_scim_auth(request: Request, authorization: Optional[str] = Header(None))
         if hasattr(scim_token, 'value'):
             scim_token = scim_token.value
         log.debug(f'SCIM token configured: {bool(scim_token)}')
-        if not scim_token or token != scim_token:
+        if not scim_token or not hmac.compare_digest(token, scim_token):
             raise HTTPException(
                 status_code=status.HTTP_401_UNAUTHORIZED,
                 detail='Invalid SCIM token',