From 0994ce9f0c7e69b866173c17384a64cc32b69127 Mon Sep 17 00:00:00 2001 From: Jeremy Stretch Date: Tue, 16 Jun 2026 05:51:36 -0400 Subject: [PATCH] Closes #22457: Use `hmac.compare_digest()` to authenticate API tokens (#22458) --- netbox/users/models/tokens.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/netbox/users/models/tokens.py b/netbox/users/models/tokens.py index 3c5afa94e..3ec614c01 100644 --- a/netbox/users/models/tokens.py +++ b/netbox/users/models/tokens.py @@ -282,7 +282,7 @@ class Token(models.Model): digest. """ if self.v1: - return token == self.token + return hmac.compare_digest(token, self.plaintext) if self.v2: token = token.removeprefix(TOKEN_PREFIX) try: @@ -291,7 +291,7 @@ class Token(models.Model): # Invalid pepper ID return False digest = hmac.new(pepper.encode('utf-8'), token.encode('utf-8'), hashlib.sha256).hexdigest() - return digest == self.hmac_digest + return hmac.compare_digest(digest, self.hmac_digest) return False def validate_client_ip(self, client_ip):