Kanidm's OAuth2 token-exchange and token-introspection endpoints use a non-constant-time comparison for the client_secret, which leaks timing information based on the length of the matching prefix. This timing discrepancy could theoretically allow an attacker to incrementally recover the secret. However, due to the high entropy of the secret, TLS protection, and network noise, practical remote exploitation is unlikely. A fix is available in version 1.9.3.