The Tell-Tale Delay: Timing Side-Channels in fastapi-api-key
Jan 21, 2026·5 min read·2 visits
Executive Summary (TL;DR)
The `fastapi-api-key` library (< 1.1.0) tried to prevent brute-forcing by adding a random delay (jitter) to failed requests. Crucially, it did *not* delay successful requests. This created a timing side-channel where valid API keys returned significantly faster than invalid ones. Attackers could exploit this asymmetry using statistical analysis to enumerate valid credentials. The fix involves applying the delay uniformly to both success and failure states.
A classic case of 'security features' creating security bugs. The fastapi-api-key library inadvertently created a timing oracle by applying rate-limiting jitter only to failed authentication attempts, allowing attackers to identify valid keys by measuring response speed.
Official Patches
Fix Analysis (1)
Technical Appendix
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:NAffected Systems
Affected Versions Detail
| Product | Affected Versions | Fixed Version |
|---|---|---|
fastapi-api-key Athroniaeth | < 1.1.0 | 1.1.0 |
| Attribute | Detail |
|---|---|
| CWE ID | CWE-208 |
| Attack Vector | Network |
| CVSS Score | 3.7 (Low) |
| Attack Complexity | High |
| Privileges Required | None |
| Exploit Status | None (No public exploit) |
MITRE ATT&CK Mapping
The product provides information about the state of a secret or sensitive operation through a timing discrepancy that is observable to an attacker.
Vulnerability Timeline
Subscribe to updates
Get the latest CVE analysis reports delivered to your inbox.