AIKIDO-2025-10565
aiogram is vulnerable to Observable Timing Discrepancy
15
Low Risk
This Affects:
aiogramTL;DR
Affected versions of this package are vulnerable to observable timing discrepancies in signature validation. The utils.web_app module compares the calculated HMAC with the provided hash using ==, which can inadvertently leak timing information and expose the application to timing attacks. While verification still functions correctly, the non-constant-time comparison creates a side channel risk. The patch replaces == with hmac.compare_digest, ensuring constant-time comparison and mitigating potential timing-based exploits.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
aiogram is vulnerable to Observable Timing Discrepancy in versions 3.0.0 - 3.21.0.
How to fix this
Upgrade the aiogram library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant