Threats affecting pkg:pypi/fastapi-api-key

CVE-2026-23996 is a timing side-channel vulnerability in the fastapi-api-key library version prior to 1.1.0. The verify_key() function applies a random delay only on verification failures, enabling attackers to statistically distinguish valid API keys by measuring response times. This can facilitate brute-force or enumeration attacks against API keys. The vulnerability impacts confidentiality by revealing valid key existence but does not affect integrity or availability. The issue is fixed in version 1.1.0 by applying uniform random delays to all responses. Mitigations include upgrading to 1.