diff --git a/app/Models/User.php b/app/Models/User.php
index afe9558c..d6299067 100644
--- a/app/Models/User.php
+++ b/app/Models/User.php
@@ -80,7 +80,7 @@ class User extends Model
     {
         // compare directly if any responses is returned by event dispatcher
         if ($result = static::getEncryptedPwdFromEvent($rawPasswd, $this)) {
-            return ($result == $this->password);
+            return hash_equals($this->password, $result);
         }
 
         return app('cipher')->verify($rawPasswd, $this->password, config('secure.salt'));