CVE-2026-23996
Timing Side-Channel Vulnerability in FastAPI Api Key Verification
Publication date: 2026-01-21
Last updated on: 2026-02-27
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| athroniaeth | fastapi_api_key | to 1.1.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-208 | Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a timing side-channel issue in the verify_key() function of FastAPI Api Key version 1.1.0. The function applied a random delay only when verification failed, which allowed attackers to measure response times and statistically determine whether an API key was valid or invalid. By making many repeated requests and analyzing the response latencies, an attacker could infer if a key_id corresponds to a valid key, potentially speeding up brute-force or enumeration attacks.
How can this vulnerability impact me? :
The vulnerability can allow an attacker to distinguish valid API keys from invalid ones by measuring response times, which can accelerate brute-force or enumeration attacks against your API keys. This could lead to unauthorized access if an attacker successfully guesses or enumerates valid keys. Users relying on verify_key() for API key authentication before the fix are affected.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by measuring response latencies to API key verification requests. An attacker can send repeated requests with different key_id values and statistically analyze the response times to distinguish valid keys from invalid ones. Specific commands are not provided in the available information.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include upgrading to FastAPI Api Key version 1.1.0 which applies a uniform random delay to all verification responses, eliminating timing side-channel leaks. Alternatively, before upgrading, you can add an application-level fixed delay or random jitter to all authentication responses (both success and failure) and/or implement rate limiting to reduce the feasibility of statistical timing attacks.