CVE-2026-23996
📋 TL;DR
FastAPI API Key version 1.1.0 has a timing side-channel vulnerability in verify_key() that allows attackers to statistically distinguish valid from invalid API keys by measuring response latencies. This could accelerate brute-force or enumeration attacks against API key authentication. All users relying on verify_key() for authentication prior to the fix are affected.
💻 Affected Systems
- FastAPI API Key
📦 What is this software?
Fastapi Api Key by Athroniaeth
⚠️ Risk & Real-World Impact
Worst Case
Attackers could enumerate valid API keys through timing analysis, leading to unauthorized API access, data breaches, or account takeover.
Likely Case
Attackers could identify valid key IDs through statistical timing analysis, reducing the search space for brute-force attacks.
If Mitigated
With proper controls, attackers would need significantly more requests to achieve statistical significance, making attacks impractical.
🎯 Exploit Status
Exploitation requires statistical analysis of timing data from many requests.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.1.0
Vendor Advisory: https://github.com/Athroniaeth/fastapi-api-key/security/advisories/GHSA-95c6-p277-p87g
Restart Required: No
Instructions:
1. Update FastAPI API Key package to version 1.1.0 or later. 2. Verify the update was successful. 3. Test authentication functionality.
🔧 Temporary Workarounds
Add application-level timing protection
allAdd fixed delay or random jitter to all authentication responses (success and failure)
Implementation depends on application framework
Implement rate limiting
allLimit authentication attempts to reduce feasibility of statistical timing attacks
Implementation depends on application framework
🧯 If You Can't Patch
- Implement strict rate limiting on authentication endpoints
- Add uniform random delays to all authentication responses
🔍 How to Verify
Check if Vulnerable:
Check if using FastAPI API Key version prior to 1.1.0 and using verify_key() for authenticationCheck Version:
pip show fastapi-api-key | grep VersionVerify Fix Applied:
Verify FastAPI API Key version is 1.1.0 or later📡 Detection & Monitoring
Log Indicators:
- Unusually high volume of authentication requests
- Requests with varying API keys from same source
Network Indicators:
- High volume of authentication requests with timing patterns
- Requests to authentication endpoints with varying parameters
SIEM Query:
source_ip:* AND (endpoint:"/auth" OR endpoint:"/authenticate") AND count > 1000 per hour