Zen-Ai-Pentest

Professional AI-Powered Penetration Testing Framework Autonomo...

Master-Engine-POC---Proprietary-Agentic-AI-Solution

Master Engine POC - Proprietary Agentic AI Solution !Pyth...

CVE-2026-23996

FastAPI Api Key provides a backend-agnostic library that provides an API key system. Version 1.1.0 has a timing side-channel vulnerability in verifykey. The method applied a random delay only on verification failures, allowing an attacker to statistically distinguish valid from invalid API keys b...

CVE-2026-23996

FastAPI Api Key provides a backend-agnostic library that provides an API key system. Version 1.1.0 has a timing side-channel vulnerability in verifykey. The method applied a random delay only on verification failures, allowing an attacker to statistically distinguish valid from invalid API keys b...

CVE-2026-23996 FastAPI Api Key has a timing side-channel in verify_key that allows statistical key validity detection

FastAPI Api Key provides a backend-agnostic library that provides an API key system. Version 1.1.0 has a timing side-channel vulnerability in verifykey. The method applied a random delay only on verification failures, allowing an attacker to statistically distinguish valid from invalid API keys b...

CVE-2026-23996

CVE-2026-23996 concerns the FastAPI Api Key library. Version 1.1.0 is reported to expose a timing side-channel in verify_key(), where a random delay is applied only on verification failures. This enables an attacker to statistically distinguish valid from invalid API keys by measuring response la...

CVE-2026-23996 FastAPI Api Key has a timing side-channel in verify_key that allows statistical key validity detection

FastAPI Api Key provides a backend-agnostic library that provides an API key system. Version 1.1.0 has a timing side-channel vulnerability in verifykey. The method applied a random delay only on verification failures, allowing an attacker to statistically distinguish valid from invalid API keys b...

CVE-2026-23996 FastAPI Api Key has a timing side-channel in verify_key that allows statistical key validity detection

FastAPI Api Key provides a backend-agnostic library that provides an API key system. Version 1.1.0 has a timing side-channel vulnerability in verifykey. The method applied a random delay only on verification failures, allowing an attacker to statistically distinguish valid from invalid API keys b...

Timing Attack

Overview fastapi-api-key is a fastapi-api-key provides secure, production-ready API key management for FastAPI. It offers pluggable hashing strategies Argon2 or bcrypt, backend-agnostic persistence currently SQLAlchemy, and an optional cache layer aiocache. Includes a Typer CLI and a FastAPI rout...

EUVD-2026-4139

FastAPI Api Key has a timing side-channel in verifykey that allows statistical key validity detection...

atomkraft (>=0.0.1, <=0.1.1), dialogy (>=0.9.21, <=2.2.1) +2 more potentially affected by CVE-2026-23986 via copier (6.2.0)

copier PYPI version 6.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on copier and may be impacted: - atomkraft =0.0.1, =0.9.21, =0.18.0, =0.1.0, =0.3.9 Source cves: CVE-2026-23986 Source advisory: OSV:GHSA-4FQP-R85R-HXQH...

entangled-cli (>=2.0.0, <=2.0.2), flet (>=0.10.0, <=0.11.0) +9 more potentially affected by CVE-2026-23986 via copier (8.3.0)

copier PYPI version 8.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on copier and may be impacted: - entangled-cli =2.0.0, =0.10.0, =0.10.0, =0.1.1, =0.1.10, =0.7.1, =0.12.5, =4.1.0b1, =4.3.0b3, =4.1.0b1, =4.1.0b1, =4.3.4rc3 Source cves:...

atomkraft (>=0.0.1, <=0.1.1), dialogy (>=0.9.21, <=2.2.1) +2 more potentially affected by CVE-2026-23968 via copier (6.2.0)

copier PYPI version 6.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on copier and may be impacted: - atomkraft =0.0.1, =0.9.21, =0.18.0, =0.1.0, =0.3.9 Source cves: CVE-2026-23968 Source advisory: OSV:GHSA-XJHM-GP88-8PFX...

FastAPI API Key security vulnerability

The FastAPI API Key is a secure key store developed by Athroniaeth’s individual developers. There is a security vulnerability in the FastAPI API Key version 1.1.0; this vulnerability stems from a timing side channel in the verifykey method, which may allow attackers to infer the validity of the A...

CVE-2026-23996: Observable Timing Discrepancy

FastAPI Api Key provides a backend-agnostic library that provides an API key system. Version 1.1.0 has a timing side-channel vulnerability in verifykey. The method applied a random delay only on verification failures, allowing an attacker to statistically distinguish valid from invalid API keys b...

FastAPI Injection RCE

Remote Code Execution exploit for FastAPI applications including template injection and code injection vulnerabilities !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient import urllib.parse import json class ModuleExploit,...

Cross-Site Request Forgery (CSRF)

fastapiusers is vulnerable to Cross-Site Request Forgery CSRF. The vulnerability is due to stateless and predictable OAuth state tokens with no session binding or per-request entropy, which allows an attacker to initiate an OAuth flow, reuse a valid state token, and trick a victim into completing...

PT-2026-25819

Name of the Vulnerable Software and Affected Versions Glances versions prior to 4.5.2 Description Glances, a system cross-platform monitoring tool, had insufficient host validation in its main REST/WebUI FastAPI application prior to version 4.5.2. This allowed the REST API, WebUI, and token...

CVE-2025-68481

FastAPI Users allows users to quickly add a registration and authentication system to their FastAPI project. Prior to version 15.0.2, the OAuth login state tokens are completely stateless and carry no per-request entropy or any data that could link them to the session that initiated the OAuth flo...

CVE-2025-68481

FastAPI Users allows users to quickly add a registration and authentication system to their FastAPI project. Prior to version 15.0.2, the OAuth login state tokens are completely stateless and carry no per-request entropy or any data that could link them to the session that initiated the OAuth flo...