CVE-2026-23996
Athroniaeth Fastapi Api Key ≤ 1.1.0
Raw vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:NSummary
CVE-2026-23996 is a low-severity Observable Timing Discrepancy (CWE-208) vulnerability in Athroniaeth Fastapi Api Key. Its CVSS base score is 3.7 (Low).
Operationally, exploitation aligns with the MITRE ATT&CK technique Brute Force (T1110); ranked at the 17th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-7 (Unsuccessful Logon Attempts) and SC-7 (Boundary Protection) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-4139
Vulnerability Data
FastAPI Api Key provides a backend-agnostic library that provides an API key system. Version 1.1.0 has a timing side-channel vulnerability in verify_key(). The method applied a random delay only on verification failures, allowing an attacker to statistically distinguish valid from…
more
invalid API keys by measuring response latencies. With enough repeated requests, an adversary could infer whether a key_id corresponds to a valid key, potentially accelerating brute-force or enumeration attacks. All users relying on verify_key() for API key authentication prior to the fix are affected. Users should upgrade to version 1.1.0 to receive a patch. The patch applies a uniform random delay (min_delay to max_delay) to all responses regardless of outcome, eliminating the timing correlation. Some workarounds are available. Add an application-level fixed delay or random jitter to all authentication responses (success and failure) before the fix is applied and/or use rate limiting to reduce the feasibility of statistical timing attacks.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Timing side-channel in API key verification directly facilitates more efficient brute-force attacks (T1110) by enabling statistical distinction of valid keys.
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Rate limiting on failed authentication attempts directly reduces the volume of repeated queries an attacker can issue to perform statistical timing analysis on verify_key().
Continuous monitoring of authentication request patterns and response-time anomalies can identify ongoing timing-based enumeration of API keys.
Boundary protection mechanisms can enforce per-source request throttling or filtering that limits an adversary's ability to gather timing samples at scale.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require constant-time implementations that eliminate observable timing discrepancies.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Consistent reference clocks limit the attacker's ability to measure or manipulate timing differences that could reveal internal state or processing paths.