AIKIDO-2026-10072

TL;DR

Affected versions of this package are vulnerable to timing attacks due to non-constant-time string comparison when validating secret tokens, which can allow an attacker to infer secret token information through timing differences; the issue is fixed by replacing the vulnerable logic with a constant-time, byte-by-byte comparison that always iterates tokenBytes.length times, prevents timing-based information leakage, and correctly handles undefined and edge cases.