{"answers":{"affected":"3 open source packages ship an affected version, including fastapi-api-key. It affects 1 product.","exploited":"There is no known exploitation of CVE-2026-23996 in the wild and no public exploit code.","fix":"Upgrade fastapi-api-key to 1.1.0 or later.","what":"CVE-2026-23996 is a low-severity vulnerability in Athroniaeth fastapi-api-key, published on 21 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-23996 and fix it if it is affected.\n\nWhat it is: CVE-2026-23996 is a low-severity vulnerability in Athroniaeth fastapi-api-key, published on 21 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-23996 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- fastapi-api-key (PyPI): affected all versions; fixed in 1.1.0\n- fastapi-api-key (PyPI): affected all versions; fixed in 1.1.0\n- fastapi-api-key (PyPI): affected all versions; fixed in 1.1.0\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-23996/ (Markdown: https://insights.sbomify.com/CVE-2026-23996/index.md)","id":"CVE-2026-23996","markdown":"https://insights.sbomify.com/CVE-2026-23996/index.md","name":"CVE-2026-23996","record":{"aliases":["GHSA-95c6-p277-p87g","PYSEC-2026-1358"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["data_read","security_bypass"],"network_reachable":"yes","non_default_config":false,"product_category":"Python API key library","requires_auth":"none","summary":"Attackers can statistically detect valid API keys via timing side-channels in verify_key, facilitating brute-force attacks against FastAPI Api Key users.","user_interaction":"not_required","vuln_class":"information_disclosure"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[{"product":"fastapi_api_key","vendor":"athroniaeth"}],"cvss":{"score":3.7,"severity":"low","source":"cna","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"cwes":[{"id":"CWE-208","name":"Observable Timing Discrepancy"}],"description":"FastAPI Api Key provides a backend-agnostic library that provides an API key system. Version 1.1.0 has a timing side-channel vulnerability in verify_key(). The method applied a random delay only on verification failures, allowing an attacker to statistically distinguish valid from invalid API keys by measuring response latencies. With enough repeated requests, an adversary could infer whether a key_id corresponds to a valid key, potentially accelerating brute-force or enumeration attacks. All users relying on verify_key() for API key authentication prior to the fix are affected. Users should upgrade to version 1.1.0 to receive a patch. The patch applies a uniform random delay (min_delay to max_delay) to all responses regardless of outcome, eliminating the timing correlation. Some workarounds are available. Add an application-level fixed delay or random jitter to all authentication responses (success and failure) before the fix is applied and/or use rate limiting to reduce the feasibility of statistical timing attacks.","ecosystems":["PyPI"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"FastAPI Api Key has a timing side-channel in verify_key that allows statistical key validity detection","id":"CVE-2026-23996","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"PyPI","product":null,"products":[],"type":"information_disclosure","year":"2026"},"n_packages":3,"n_references":3,"next":{"headline":"FacturaScripts has a Stored Cross-Site Scripting (XSS) in \"Observations\" field via History View","id":"CVE-2026-23997"},"packages":[{"ecosystem":"PyPI","fixed":["1.1.0"],"introduced":["0"],"last_affected":[],"package":"fastapi-api-key","purl":null,"source":"GHSA-95c6-p277-p87g"},{"ecosystem":"PyPI","fixed":["1.1.0"],"introduced":["0"],"last_affected":[],"package":"fastapi-api-key","purl":"pkg:pypi/fastapi-api-key","source":"GHSA-95c6-p277-p87g"},{"ecosystem":"PyPI","fixed":["1.1.0"],"introduced":["0"],"last_affected":[],"package":"fastapi-api-key","purl":"pkg:pypi/fastapi-api-key","source":"PYSEC-2026-1358"}],"prev":{"headline":"EVerest has stack buffer overflow in ifreq.ifr_name when interface name exceeds IFNAMSIZ","id":"CVE-2026-23995"},"products":["fastapi-api-key"],"published":"2026-01-21","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CC BY 4.0","name":"PyPA Advisory Database","prefix":"PYSEC"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-01-22","vendors":["Athroniaeth"]},"summary":"Attackers can statistically detect valid API keys via timing side-channels in verify_key, facilitating brute-force attacks against FastAPI Api Key users.","url":"https://insights.sbomify.com/CVE-2026-23996/"}