The mul_mod function in PyQuorum performs multiplication using a binary expansion loop whose execution time is influenced by the Hamming weight of the second operand, essentially an exponent. This timing variability allows an attacker who can observe operation durations—such as through a remote service—to determine the exponent on a run‑by‑run basis. Because PyQuorum is used for secret‑sharing and key‑management, successive recovery of share values eventually yields the protected secret. The vulnerability is a classic example of a timing side‑channel (CWE‑208).

The flaw affects the PyQuorum library distributed by svvqt prior to its 0.2.1 release. Any deployment of an older version that performs mul_mod under potentially observable conditions is susceptible.

The CVSS score of 6.9 indicates moderate overall severity. While no EPSS score is presently available, the likelihood of exploitation is non‑negligible given the remote timing attack possibility, and the vulnerability is not yet catalogued in the CISA KEV list. The likely attack vector is a remote timing side‑channel: an attacker exploiting a remote service that runs secret‑sharing operations can measure response times to gradually deduce share values.