A timing side-channel vulnerability was identified in vLLM’s API token verification logic. The comparison of API tokens was not performed in constant time, which could allow an attacker to measure subtle differences in response times to infer valid tokens. Exploitation of this flaw could enable authentication bypass, granting unauthorized access to APIs and sensitive resources. 
Affected Versions: vLLM ≤ 0.10.2 
Fixed Version: vLLM 0.10.3