GHSA-xg4x-w2j3-57h6
Medium · 5.9CVSS
5.9
EPSS
—
Published
Jan 27, 2026
CISA due date
—
The record
OctoPrint has Timing Side-Channel Vulnerability in API Key Authentication
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| PyPI | octoprint | 0 | 1.11.6 |
Related vulnerabilities
- CVE-2026-23892 OctoPrint provides a web interface for controlling consumer 3D printers. Same vulnerability
- CVE-2025-64187 OctoPrint is vulnerable to XSS through Action Command Notifications and Prompts Also affects octoprint
- GHSA-crvm-xjhm-9h29 OctoPrint vulnerable to XSS in Action Commands Notification and Prompt Also affects octoprint
- CVE-2025-58180 OctoPrint is Vulnerable to RCE Attacks via Unsanitized Filename in File Upload Also affects octoprint
- CVE-2026-87946 Observable Timing Discrepancy vulnerability in Drupal SAML SSO - Service Provider allows… CWE-208
- CVE-2026-49265 OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. CWE-208
- CVE-2026-77696 Issue summary: SM2 signature generation uses non-constant-time arithmetic on secret… CWE-208
- CVE-2026-54875 Issue summary: A non-constant-time optimized implementation of scalar point… CWE-208