PyPI/fastapi-api-key CVE-2026-23996: low 3.7, EPSS 0.29%

FastAPI Api Key has a timing side-channel in verify_key that allows statistical key validity detection

Action: Upgrade fastapi-api-key to 1.1.0 or later.

pip install fastapi-api-key==1.1.0

Affected

Fixed versions

Sources

• osv: PYSEC-2026-1358
• https://github.com/Athroniaeth/fastapi-api-key/security/advisories/GHSA-95c6-p277-p87g
• https://nvd.nist.gov/vuln/detail/CVE-2026-23996
• https://github.com/Athroniaeth/fastapi-api-key/commit/310b2c5c77305f38c63c0b917539a0344071dfd8
• https://github.com/Athroniaeth/fastapi-api-key
• https://github.com/Athroniaeth/fastapi-api-key/releases/tag/1.1.0
• https://pypi.org/project/fastapi-api-key
• https://github.com/advisories/GHSA-95c6-p277-p87g

CVE-2026-23996 · published 2026-07-07T16:03:19.699103Z · modified 2026-07-07T17:47:35.926091029Z · JSON