CVE-2026-41588: Python Non Constant Time Secret Comparison

Non-constant-time comparison of secret/token field '$ATTR' using the == operator. Python's str.__eq__ short-circuits on the first mismatching byte, leaking timing information that allows an attacker to recover the secret byte-by-byte (CWE-208). Replace with secrets.compare_digest($OBJ.$ATTR, $TOKEN) or hmac.compare_digest($OBJ.$ATTR, $TOKEN), which run in co

Provally CuratedPublic repositoryHighHigh confidenceVerifiedApache-2.0Python
greprules fetch cve-2026-41588-python-non-constant-time-secret-comparison --engine opengrep

Description

Non-constant-time comparison of secret/token field '$ATTR' using the == operator. Python's str.__eq__ short-circuits on the first mismatching byte, leaking timing information that allows an attacker to recover the secret byte-by-byte (CWE-208). Replace with secrets.compare_digest($OBJ.$ATTR, $TOKEN) or hmac.compare_digest($OBJ.$ATTR, $TOKEN), which run in co