Executive brief
LightRAG is a Python library that provides API authentication. When plaintext passwords are stored (not hashed), the password verification code uses a non-constant-time comparison that leaks password information through timing side-channels. An attacker with network access can measure response times to systematically recover passwords character-by-character without hitting brute-force protections, compromising account security for systems using plaintext password storage.
Technical details
The vulnerability is a timing oracle in the verify_password() function (lightrag/api/passwords.py:13-26) that compares plaintext passwords using Python's == operator instead of a constant-time comparison function. The == operator short-circuits on the first mismatched byte, causing measurably different response times based on how many characters match. An attacker with low-latency network access can measure login endpoint response times to determine each character of the password sequentially without triggering brute-force detection. The vulnerability only affects deployments where AUTH_ACCOUNTS contains plaintext passwords rather than bcrypt hashes. A proof-of-concept exploit demonstrates character-by-character password recovery via timing measurement. The fix is available in version 1.5.5, which presumably implements constant-time comparison.
Affected products
- HKUDS LightRAG <= 1.5.4
Timeline
- 2026-07-18: disclosed: Published to GitHub Advisory Database
- 2026-09-22: advisory: Published to NVD
- 2026-09-22: patched: Version 1.5.5 released with fix