AIKIDO-2026-10141

TL;DR

Affected versions of this package contain CSRF token validation logic vulnerable to timing side-channel attacks due to non-constant time comparisons and weak secret generation. An attacker could exploit subtle response timing differences when comparing CSRF tokens to iteratively infer valid token values, enabling CSRF bypass or unauthorized state-changing requests. Additionally, low-entropy, improperly encoded secrets reduce brute-force resistance, compounding the risk when combined with timing analysis.