3.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-23996

CVE-2026-23996: FastAPI Api Key has a timing side-channel in verify_key that allows statistical key validity detection

FastAPI Api Key provides a backend-agnostic library that provides an API key system. Version 1.1.0 has a timing side-channel vulnerability in verify_key(). The method applied a random delay only on verification failures, allowing an attacker to statistically distinguish valid from invalid API keys by measuring response latencies. With enough repeated requests, an adversary could infer whether a key_id corresponds to a valid key, potentially accelerating brute-force or enumeration attacks. All users relying on verify_key() for API key authentication prior to the fix are affected. Users should upgrade to version 1.1.0 to receive a patch. The patch applies a uniform random delay (min_delay to max_delay) to all responses regardless of outcome, eliminating the timing correlation. Some workarounds are available. Add an application-level fixed delay or random jitter to all authentication responses (success and failure) before the fix is applied and/or use rate limiting to reduce the feasibility of statistical timing attacks.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-23996

CVE-2026-23996:

3.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
fastapi-api-key	pip	< 1.1.0	1.1.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a timing side-channel in the verify_key method, which is part of the AbstractApiKeyService class. The issue stems from the fact that a random delay was only applied when an API key verification failed and an exception was raised. This created a measurable difference in response times between requests with valid keys and those with invalid keys. An attacker could exploit this by sending a large number of requests with different keys and analyzing the response times to statistically determine which keys are valid.

The patch, identified in commit 310b2c5c77305f38c63c0b917539a0344071dfd8, resolves this by applying a random delay to all verification responses, regardless of whether the key is valid or not. This is achieved by moving the delay logic out of the except block and ensuring it is called for both successful and unsuccessful verification paths. The vulnerable functions that would appear in a runtime profile are the verify_key methods of the concrete classes ApiKeyService and CachedApiKeyService, as they inherit the flawed logic from AbstractApiKeyService.

Vulnerable functions

AbstractApiKeyService.verify_key

src/fastapi_api_key/services/base.py

The `verify_key` method in the `AbstractApiKeyService` class implemented a delay only when an exception was caught (i.e., on key verification failure). This created a timing discrepancy between successful and failed verifications, which could be exploited by an attacker to statistically determine if an API key is valid or not. The vulnerability is present in any class that inherits from this abstract class.

ApiKeyService.verify_key

src/fastapi_api_key/services/base.py

As `ApiKeyService` inherits from `AbstractApiKeyService`, its `verify_key` method contained the timing side-channel vulnerability. This is a concrete implementation of the abstract service and is a function that would appear in a runtime profile during exploitation.

CachedApiKeyService.verify_key

src/fastapi_api_key/services/cached.py

As `CachedApiKeyService` inherits from `ApiKeyService` (which inherits from `AbstractApiKeyService`), its `verify_key` method also contained the timing side-channel vulnerability. This is another concrete implementation that would appear in a runtime profile during exploitation.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.