Open-Source Security Intelligence

Know every vulnerability
before it knows you.

DevGuard continuously monitors your dependencies and alerts you when CVEs like this one affect your stack — with real-time threat intelligence built for developers.

Checkout DevGuard View on GitHub

PYSEC-2026-1358

LowCVSS 3.7 / 10

Published Jul 7, 2026·Last modified Jul 7, 2026

Affected Components(1)

fastapi-api-key

< 1.1.0

Description

Impact

Timing side-channel vulnerability in verify_key(). The method applied a random delay only on verification failures, allowing an attacker to statistically distinguish valid from invalid API keys by measuring response latencies. With enough repeated requests, an adversary could infer whether a key_id corresponds to a valid key, potentially accelerating brute-force or enumeration attacks.

Affected: all users relying on verify_key() for API key authentication prior to the fix.

Patches

Yes. Users should upgrade to version 1.1.0 (or the version containing this fix). The patch applies a uniform random delay (min_delay to max_delay) to all responses regardless of outcome, eliminating the timing correlation.

Workarounds

Add an application-level fixed delay or random jitter to all authentication responses (success and failure) before the fix is applied.
Use rate limiting to reduce the feasibility of statistical timing attacks.

References

CWE-208: Observable Timing Discrepancy
Commit: 87b27640f77c5ef86c46311b6b5a7e2887e35b77
OWASP: https://owasp.org/www-community/attacks/Timing_attack

Risk Scores

Base Score

3.7

The vulnerability can be exploited over the network without needing physical access. It is difficult for an attacker to exploit this vulnerability and may require special conditions. An attacker does not need any special privileges or access rights. No user interaction is needed for the attacker to exploit this vulnerability. The impact is confined to the system where the vulnerability exists. There is a low impact on the confidentiality of the information.

Threat Intelligence

3.4

Limited exploitation activity has been observed. Close monitoring and planned remediation are recommended.

EPSS

0.25%

The exploit probability is very low. The vulnerability is unlikely to be exploited in the next 30 days.

Exploit

Not available

We did not find any exploit available. Neither in GitHub repositories nor in the Exploit-Database.

Related Vulnerabilities

CVE-2026-23996
FastAPI Api Key provides a backend-agnostic library that provides an API key system. Version 1.1.0 has a timing side-channel vulnerability in verify_key(). The method applied a random delay only on verification failures, allowing an attacker to statistically distinguish valid from invalid API keys by measuring response latencies. With enough repeated requests, an adversary could infer whether a key_id corresponds to a valid key, potentially accelerating brute-force or enumeration attacks. All users relying on verify_key() for API key authentication prior to the fix are affected. Users should upgrade to version 1.1.0 to receive a patch. The patch applies a uniform random delay (min_delay to max_delay) to all responses regardless of outcome, eliminating the timing correlation. Some workarounds are available. Add an application-level fixed delay or random jitter to all authentication responses (success and failure) before the fix is applied and/or use rate limiting to reduce the feasibility of statistical timing attacks.
AliasLow 3.7

Browse More

Low severity

Scan your project

Continuously monitor your dependencies and get alerted when vulnerabilities like this one affect your stack.