# CVE-2026-39413: HKUDS LightRAG JWT algorithm confusion in API auth

Source: https://junglewise.ai/threats/cve-2026-39413-hkuds-lightrag-jwt-algorithm-confusion-in-api-auth  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-08. Updated: 2026-07-24  
License: CC BY 4.0 with a link back

CVE-2026-39413 · Severity: medium · CVSS 4.2 · Published 2026-04-08

LightRAG, a tool used for fast retrieval-augmented generation in AI applications, contains a security flaw in its API authentication. An attacker can bypass security checks by providing a specially crafted login token that claims to have no security signature. This allows unauthorized individuals to impersonate users, including administrators, potentially leading to full access to sensitive data and protected system resources.

Technologies: [HKUDS LightRAG](https://junglewise.ai/threats/technologies/lightrag), [lightrag-hku (PyPI)](https://junglewise.ai/threats/technologies/lightrag-hku). Vendors: [HKUDS](https://junglewise.ai/threats/vendors/hkuds), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-39413 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-39413 being exploited in the wild.

**How severe is CVE-2026-39413?** Medium severity, with a CVSS score of 4.2, published 8 April 2026.

**Which products and versions are affected?** HKUDS LightRAG < 1.4.14; lightrag-hku (PyPI) ECOSYSTEM:introduced=0,fixed=1.4.14.

**Is there a fix for CVE-2026-39413?** Yes. lightrag-hku (PyPI): upgrade to 1.4.14 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-39413 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-39413?** Check whether you run HKUDS LightRAG or lightrag-hku (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- lightrag-hku (PyPI): upgrade to 1.4.14 or later

  ```sh
  pip install "lightrag-hku>=1.4.14"
  ```


## Technical details

The LightRAG API is vulnerable to a JWT algorithm confusion attack in the `validate_token` method within `lightrag/api/auth.py`. The root cause is that the `jwt.decode()` call does not explicitly restrict the allowed algorithms, permitting the 'none' algorithm to be accepted. A remote attacker can exploit this by crafting a JWT with the 'alg' header set to 'none' and omitting the signature. This allows the attacker to bypass authentication and impersonate any user, including administrators. The vulnerability is fixed in version 1.4.14 by explicitly defining allowed cryptographic algorithms.

## Affected products

- HKUDS LightRAG < 1.4.14

## Identifiers

- CVE-2026-39413
- GHSA-8ffj-4hx4-9pgf
- PYSEC-2026-2592

## Timeline

- 2026-04-07: advisory: GitHub Security Advisory GHSA-8ffj-4hx4-9pgf published
- 2026-04-08: disclosed: CVE-2026-39413 published to NVD
- 2026-04-14: patched: Vulnerability fixed in version 1.4.14

## References

- [https://github.com/HKUDS/LightRAG/security/advisories/GHSA-8ffj-4hx4-9pgf](https://github.com/HKUDS/LightRAG/security/advisories/GHSA-8ffj-4hx4-9pgf)

## Related threats

- [LightRAG WebUI stored XSS in chat answer renderer](https://junglewise.ai/threats/cve-2026-86062-lightrag-webui-stored-xss-in-chat-answer-renderer)
- [LightRAG SSRF via IPv6-transition address bypass in markdown image download](https://junglewise.ai/threats/cve-2026-85740-lightrag-ssrf-via-ipv6-transition-address-bypass-in-markdown)
- [lightrag-hku /login endpoint missing rate limiting enables brute-force attacks](https://junglewise.ai/threats/cve-2026-85734-lightrag-hku-login-endpoint-missing-rate-limiting-enables-brute)
- [LightRAG plaintext password timing attack vulnerability](https://junglewise.ai/threats/cve-2026-85725-lightrag-plaintext-password-timing-attack-vulnerability)
- [LightRAG API sensitive information exposure in error responses](https://junglewise.ai/threats/cve-2026-85709-lightrag-api-sensitive-information-exposure-in-error-responses)