CVE-2026-41588: Python Non Constant Time Secret Comparisoncve-2026-41588-python-non-constant-time-secret-comparison
Non-constant-time comparison of secret/token field '$ATTR' using the == operator. Python's str.__eq__ short-circuits on the first mismatching byte, leaking timing information that allows an attacker to recover the secret byte-by-byte (CWE-208). Replace with secrets.compare_digest($OBJ.$ATTR, $TOKEN) or hmac.compare_digest($OBJ.$ATTR, $TOKEN), which run in co
