AIKIDO-2026-10161

TL;DR

Affected versions of this package expose the full plaintext virtual key in error responses when an expired key is used, constituting a secrecy violation even though the key is no longer valid. An attacker can exploit this by capturing expired keys from logs, API responses, or monitoring systems and later abusing them if an administrator reactivates the key via the update endpoint, or by leveraging the leaked secret for audit evasion, access pattern reconstruction, or targeted social-engineering attacks, all of which violate standard secret-handling and compliance requirements.