ReportizFlow
vLLM is an inference and serving engine for large language models (LLMs). Before version 0.11.0rc2, the API key support in vLLM performs validation using a method that was vulnerable to a timing attack. API key validation uses a string comparison that takes longer the more characters the provided API key gets correct. Data analysis across many attempts could allow an attacker to determine when it finds the next correct character in the key sequence. Deployments relying on vLLM's built-in API key validation are vulnerable to authentication bypass using this technique. Version 0.11.0rc2 fixes the issue.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Vllm-project |
|
No data.
No data.
References
History
Wed, 08 Oct 2025 13:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Vllm-project
Vllm-project vllm |
|
| Vendors & Products |
Vllm-project
Vllm-project vllm |
Tue, 07 Oct 2025 16:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Tue, 07 Oct 2025 14:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A flaw was found in vLLM’s API token authentication logic, where token comparisons were not performed in constant time. This weakness could allow an attacker to exploit timing differences to guess valid tokens and bypass authentication. | vLLM is an inference and serving engine for large language models (LLMs). Before version 0.11.0rc2, the API key support in vLLM performs validation using a method that was vulnerable to a timing attack. API key validation uses a string comparison that takes longer the more characters the provided API key gets correct. Data analysis across many attempts could allow an attacker to determine when it finds the next correct character in the key sequence. Deployments relying on vLLM's built-in API key validation are vulnerable to authentication bypass using this technique. Version 0.11.0rc2 fixes the issue. |
| Title | vllm: Timing Attack in vLLM API Token Verification Leading to Authentication Bypass | vLLM vulnerable to timing attack at bearer auth |
| Weaknesses | CWE-385 | |
| References |
|
|
Tue, 07 Oct 2025 12:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A flaw was found in vLLM’s API token authentication logic, where token comparisons were not performed in constant time. This weakness could allow an attacker to exploit timing differences to guess valid tokens and bypass authentication. | |
| Title | vllm: Timing Attack in vLLM API Token Verification Leading to Authentication Bypass | |
| Weaknesses | CWE-208 | |
| References |
| |
| Metrics |
threat_severity
|
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published: 2025-10-07T14:06:49.042Z
Updated: 2025-10-07T15:28:10.303Z
Reserved: 2025-09-15T19:13:16.905Z
Link: CVE-2025-59425
Vulnrichment
Updated: 2025-10-07T14:32:28.595Z
NVD
Status : Received
Published: 2025-10-07T14:15:38.950
Modified: 2025-10-07T14:15:38.950
Link: CVE-2025-59425
Redhat