CVE-2021-33880
Observable Timing Discrepancy in aaugustin websockets library
The aaugustin websockets library before 9.1 for Python has an Observable Timing Discrepancy on servers when HTTP Basic Authentication is enabled with basic_auth_protocol_factory(credentials=...). An attacker may be able to guess a password via a timing attack.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
The aaugustin websockets library before 9.1 for Python has an Observable Timing Discrepancy on servers when HTTP Basic Authentication is enabled with basic_auth_protocol_factory(credentials=...). An attacker may be able to guess a password via a timing attack.
- Record
CVE-2021-33880- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS 2.0
- 2.6 Low
AV:N/AC:H/Au:N/C:P/I:N/A:N - Weakness
- CWE-203
- Updated
- 2026-11-02
CVE List No score
The aaugustin websockets library before 9.1 for Python has an Observable Timing Discrepancy on servers when HTTP Basic Authentication is enabled with basic_auth_protocol_factory(credentials=...). An attacker may be able to guess a password via a timing attack.
- Record
CVE-2021-33880- Updated
- 2026-11-02
EUVDEUVD-2021-0467 No score
The aaugustin websockets library before 9.1 for Python has an Observable Timing Discrepancy on servers when HTTP Basic Authentication is enabled with basic_auth_protocol_factory(credentials=...). An attacker may be able to guess a password via a timing attack.
- Record
EUVD-2021-0467- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-8ch4-58qp-g3mp
Observable Timing Discrepancy in aaugustin websockets library
The aaugustin websockets library before 9.1 for Python has an Observable Timing Discrepancy on servers when HTTP Basic Authentication is enabled with basic_auth_protocol_factory(credentials=...). An attacker may be able to guess a password via a timing attack.
- Record
GHSA-8ch4-58qp-g3mp- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-203, CWE-208
- Updated
- 2026-11-02
OSV
The aaugustin websockets library before 9.1 for Python has an Observable Timing Discrepancy on servers when HTTP Basic Authentication is enabled with basic_auth_protocol_factory(credentials=...). An attacker may be able to guess a password via a timing attack.
- Record
CVE-2021-33880- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2021-33880
The aaugustin websockets library before 9.1 for Python has an Observable Timing Discrepancy on servers when HTTP Basic Authentication is enabled with basic_auth_protocol_factory(credentials=...). An attacker may be able to guess a password via a timing attack.
- Record
DEBIAN-CVE-2021-33880- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
Show 4 moreShow less
OSVGHSA-8ch4-58qp-g3mp
Observable Timing Discrepancy in aaugustin websockets library
The aaugustin websockets library before 9.1 for Python has an Observable Timing Discrepancy on servers when HTTP Basic Authentication is enabled with basic_auth_protocol_factory(credentials=...). An attacker may be able to guess a password via a timing attack.
- Record
GHSA-8ch4-58qp-g3mp- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-203, CWE-208
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2021-33880
The aaugustin websockets library before 9.1 for Python has an Observable Timing Discrepancy on servers when HTTP Basic Authentication is enabled with basic_auth_protocol_factory(credentials=...). An attacker may be able to guess a password via a timing attack.
- Record
UBUNTU-CVE-2021-33880- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVCLSA-2025-1764115973 No score
TuxCare security update for websockets (1 CVE)
TuxCare rebuilt websockets to address 1 CVE. Fixed in 8.1.post1+tuxcare.
- Record
CLSA-2025-1764115973- Updated
- 2026-11-02
OSVPYSEC-2021-95 No score
The aaugustin websockets library before 9.1 for Python has an Observable Timing Discrepancy on servers when HTTP Basic Authentication is enabled with basic_auth_protocol_factory(credentials=...). An attacker may be able to guess a password via a timing attack.
- Record
PYSEC-2021-95- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
websocketsPyPI |
before 9.1 | 9.1 |
websocketsTuxCare:PyPI |
8.1 up to 8.1.post1+tuxcare | 8.1.post1+tuxcare |
python-websocketsDebian:12 |
before 9.1-1 | 9.1-1 |
python-websocketsDebian:13 |
before 9.1-1 | 9.1-1 |
python-websocketsDebian:14 |
before 9.1-1 | 9.1-1 |
websocketsPyPI |
before 9.1, plus listed versions 0.11.02.02.12.2 Show 23 moreShow less2.32.42.52.62.73.03.13.23.33.44.04.0.15.05.0.16.07.08.08.0.18.0.28.19.09.0.19.0.2 |
9.1 |
python-websocketsUbuntu:16.04:LTS |
All versions, plus listed versions 2.6-13.0-1 |
None known |
python-websocketsUbuntu:18.04:LTS |
All versions, plus listed versions 3.3-13.4-1 |
None known |
python-websocketsUbuntu:20.04:LTS |
All versions, plus listed versions 7.0-18.1-1 |
None known |
python-websocketsUbuntu:22.04:LTS |
All versions, plus listed versions 8.1-19.1-1 |
None known |
Show 4 moreShow less
| Package | Affected | Fixed |
|---|---|---|
python-websocketsUbuntu:24.04:LTS |
All versions, plus listed versions 10.4-1 |
None known |
python-websocketsUbuntu:25.10 |
All versions, plus listed versions 14.1-1build115.0.1-1 |
None known |
python-websocketsUbuntu:26.10 |
All versions, plus listed versions 15.0.1-1build216.0-1 |
None known |
python-websocketsUbuntu:26.04:LTS |
All versions, plus listed versions 15.0.1-115.0.1-1build115.0.1-1build2 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-33880 is a medium vulnerability (CVSS 5.9) in Websockets Project Websockets, published June 6, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.27%, the 83rd percentile. Fixed in websockets 9.1.
References
github.com/aaugustin/websockets/commit/547a26b685d08cac0aa64e5e65f7867ac0ea9bc0
oracle.com/security-alerts/cpujan2022.html
nvd.nist.gov/vuln/detail/CVE-2021-33880