vLLM is an inference and serving engine for large language models (LLMs). Before version 0.11.0rc2, the API key support in vLLM performs validation using a method that was vulnerable to a timing attack. API key validation uses a string comparison that takes longer the more characters the provided API key gets correct. Data analysis across many attempts could allow an attacker to determine when it finds the next correct character in the key sequence. Deployments relying on vLLM's built-in API key validation are vulnerable to authentication bypass using this technique. Version 0.11.0rc2 fixes the issue.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
References
History
Tue, 07 Oct 2025 14:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A flaw was found in vLLM’s API token authentication logic, where token comparisons were not performed in constant time. This weakness could allow an attacker to exploit timing differences to guess valid tokens and bypass authentication. | vLLM is an inference and serving engine for large language models (LLMs). Before version 0.11.0rc2, the API key support in vLLM performs validation using a method that was vulnerable to a timing attack. API key validation uses a string comparison that takes longer the more characters the provided API key gets correct. Data analysis across many attempts could allow an attacker to determine when it finds the next correct character in the key sequence. Deployments relying on vLLM's built-in API key validation are vulnerable to authentication bypass using this technique. Version 0.11.0rc2 fixes the issue. |
| Title | vllm: Timing Attack in vLLM API Token Verification Leading to Authentication Bypass | vLLM vulnerable to timing attack at bearer auth |
| Weaknesses | CWE-385 | |
| References |
|
|
Tue, 07 Oct 2025 12:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A flaw was found in vLLM’s API token authentication logic, where token comparisons were not performed in constant time. This weakness could allow an attacker to exploit timing differences to guess valid tokens and bypass authentication. | |
| Title | vllm: Timing Attack in vLLM API Token Verification Leading to Authentication Bypass | |
| Weaknesses | CWE-208 | |
| References |
| |
| Metrics |
threat_severity
|
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published:
Updated: 2025-10-07T15:28:10.303Z
Reserved: 2025-09-15T19:13:16.905Z
Link: CVE-2025-59425
Vulnrichment
No data.
NVD
Status : Received
Published: 2025-10-07T14:15:38.950
Modified: 2025-10-07T14:15:38.950
Link: CVE-2025-59425
Redhat
OpenCVE Enrichment
No data.