Unauthenticated user enumeration via bcrypt timing oracle

Observable timing discrepancy in 4ga Boards before 3.3.5 allows remote attackers to enumerate valid accounts through the login endpoint. The unauthenticated POST /api/access-tokens handler in server/api/controllers/access-tokens/create.js skips bcrypt.compareSync() for unknown accounts but runs it for valid accounts with a wrong password. A single network request can distinguish the paths, and absent rate limiting permits rapid collection of account email addresses for later password attacks.