From 0050085b7219ceddcc768df79b47da067773fd6b Mon Sep 17 00:00:00 2001
From: Henrik Gemal <henrik@gemal.dk>
Date: Wed, 2 Sep 2026 16:50:06 +0200
Subject: [PATCH] use hash_equals

---
 src/PasswordHasher/LegacyPasswordHasher.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/PasswordHasher/LegacyPasswordHasher.php b/src/PasswordHasher/LegacyPasswordHasher.php
index 9d1b256b..12684dda 100644
--- a/src/PasswordHasher/LegacyPasswordHasher.php
+++ b/src/PasswordHasher/LegacyPasswordHasher.php
@@ -73,6 +73,6 @@ public function hash($password): string
      */
     public function check($password, string $hashedPassword): bool
     {
-        return $hashedPassword === $this->hash($password);
+        return hash_equals($hashedPassword, $this->hash($password));
     }
 }