FastAPI Api Key implements an API key authentication mechanism that, prior to the latest patch, introduced a timing side‑channel in the verify_key() function. The function applied a random delay only when verification failed, creating a measurable latency difference between valid and invalid keys. With repeated requests, an attacker could statistically distinguish valid key identifiers, enabling efficient brute‑force or enumeration attacks against the key space. The vulnerability falls under CWE‑208, which pertains to timing issues that expose sensitive information.

Applications that use the Athroniaeth fastapi‑api‑key library and invoke verify_key() for authentication are affected. The vulnerability applies to all versions up to and including 1.1.0; systems running newer releases that incorporate the uniform random delay patch are considered fixed.

The CVSS score of 3.7 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Attackers would likely employ a statistical approach, sending many timed requests to map out valid vs. invalid keys. No elevated privileges or remote code execution are required; the impact is limited to information disclosure—specifically, knowledge of valid key identifiers that could facilitate further credential‑based attacks.