GHSA-95c6-p277-p87g
Low · 3.7CVSS
3.7
EPSS
—
Published
Jan 21, 2026
CISA due date
—
The record
FastAPI Api Key has a timing side-channel in verify_key that allows statistical key validity detection
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| PyPI | fastapi-api-key | 0 | 1.1.0 |
Related vulnerabilities
- CVE-2026-23996 FastAPI Api Key provides a backend-agnostic library that provides an API key system. Same vulnerability
- CVE-2026-87946 Observable Timing Discrepancy vulnerability in Drupal SAML SSO - Service Provider allows… CWE-208
- CVE-2026-49265 OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. CWE-208
- CVE-2026-77696 Issue summary: SM2 signature generation uses non-constant-time arithmetic on secret… CWE-208
- CVE-2026-54875 Issue summary: A non-constant-time optimized implementation of scalar point… CWE-208
- CVE-2026-54872 Issue summary: The generic elliptic-curve scalar multiplication used for ECDSA and SM2… CWE-208
- CVE-2026-87737 An issue was discovered in the mirage-crypto-ec package before 2.4.0 for OCaml. CWE-208
- CVE-2026-84308 phpseclib is a PHP secure communications library. CWE-208