PT-2026-105818

Summary The POST /login endpoint has no rate limiting, account lockout, or delay on failed attempts. An attacker can submit unlimited password guesses at full network speed. Details python lightrag/api/lightrag server.py:2161 @app.post"/login" async def loginform data: OAuth2PasswordRequestForm =...