Executive brief
Lord of Large Language Models vulnerable to Observable Discrepancy attack via authenticate_user function
Affected products
- PyPI lollms
Junglewise Threat Intelligence
CVE-2025-6386: PYSEC-2026-1590 - Lord of Large Language Models vulnerable to Observable Discrepancy attack via authenticate_user function
CVE-2025-6386 · Severity: low · CVSS 3 · Published 2026-07-07
Technologies: lollms (PyPI). Vendors: PyPI.
Related threats
- PYSEC-2026-1586 - Lollms has an Improper Access Control vulnerability
- PYSEC-2026-1591 - LoLLMS Code Injection vulnerability
- PYSEC-2026-1585 - Lord of Large Language Models (LoLLMs) Server path traversal vulnerability in lollms_file_system.py
- PYSEC-2026-1587 - LoLLMS vulnerable to Expected Behavior Violation
- PYSEC-2026-1592 - lollms path traversal vulnerability allows overriding of config.yaml file, leading to RCE