« Volver al listado

CVE-2026-23996

Estado: AnalizadaBaja (3.7)—

FastAPI Api Key provides a backend-agnostic library that provides an API key system. Version 1.1.0 has a timing side-channel vulnerability in verify_key(). The method applied a random delay only on verification failures, allowing an attacker to statistically distinguish valid from invalid API keys by measuring response latencies. With enough repeated requests, an adversary could infer whether a key_id corresponds to a valid key, potentially accelerating brute-force or enumeration attacks. All users relying on verify_key() for API key authentication prior to the fix are affected.

Leer descripción completaMostrar menos

Users should upgrade to version 1.1.0 to receive a patch. The patch applies a uniform random delay (min_delay to max_delay) to all responses regardless of outcome, eliminating the timing correlation. Some workarounds are available. Add an application-level fixed delay or random jitter to all authentication responses (success and failure) before the fix is applied and/or use rate limiting to reduce the feasibility of statistical timing attacks.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Athroniaeth — Fastapi API KEY

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-23996",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-23996",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-01-22T15:09:24.050000Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 3.7,
          "attackVector": "NETWORK",
          "baseSeverity": "LOW",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.2
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "Athroniaeth",
          "product": "fastapi-api-key",
          "versions": [
            {
              "status": "affected",
              "version": "< 1.1.0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-01-21T23:15:53.090",
  "references": [
    {
      "url": "https://github.com/Athroniaeth/fastapi-api-key/commit/310b2c5c77305f38c63c0b917539a0344071dfd8",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/Athroniaeth/fastapi-api-key/releases/tag/1.1.0",
      "tags": [
        "Product",
        "Release Notes"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/Athroniaeth/fastapi-api-key/security/advisories/GHSA-95c6-p277-p87g",
      "tags": [
        "Mitigation",
        "Patch",
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-208"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "FastAPI Api Key provides a backend-agnostic library that provides an API key system. Version 1.1.0 has a timing side-channel vulnerability in verify_key(). The method applied a random delay only on verification failures, allowing an attacker to statistically distinguish valid from invalid API keys by measuring response latencies. With enough repeated requests, an adversary could infer whether a key_id corresponds to a valid key, potentially accelerating brute-force or enumeration attacks. All users relying on verify_key() for API key authentication prior to the fix are affected. Users should upgrade to version 1.1.0 to receive a patch. The patch applies a uniform random delay (min_delay to max_delay) to all responses regardless of outcome, eliminating the timing correlation. Some workarounds are available. Add an application-level fixed delay or random jitter to all authentication responses (success and failure) before the fix is applied and/or use rate limiting to reduce the feasibility of statistical timing attacks."
    },
    {
      "lang": "es",
      "value": "FastAPI Api Key proporciona una librería agnóstica al backend que proporciona un sistema de claves API. La versión 1.1.0 tiene una vulnerabilidad de canal lateral de temporización en verify_key(). El método aplicó un retraso aleatorio solo en fallos de verificación, permitiendo a un atacante distinguir estadísticamente las claves API válidas de las inválidas midiendo las latencias de respuesta. Con suficientes solicitudes repetidas, un adversario podría inferir si un key_id corresponde a una clave válida, acelerando potencialmente los ataques de fuerza bruta o enumeración. Todos los usuarios que dependen de verify_key() para la autenticación de claves API antes de la corrección se ven afectados. Los usuarios deben actualizar a la versión 1.1.0 para recibir un parche. El parche aplica un retraso aleatorio uniforme (min_delay a max_delay) a todas las respuestas independientemente del resultado, eliminando la correlación de temporización. Hay disponibles algunas soluciones alternativas. Añadir un retraso fijo a nivel de aplicación o fluctuación aleatoria a todas las respuestas de autenticación (éxito y fallo) antes de que se aplique la corrección y/o usar la limitación de velocidad para reducir la viabilidad de los ataques de temporización estadísticos."
    }
  ],
  "lastModified": "2026-06-17T10:22:26.950",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:athroniaeth:fastapi_api_key:*:*:*:*:*:python:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9E32065D-0671-42EB-8A49-1434ECD4EE54",
              "versionEndExcluding": "1.1.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}