CVE-2026-85725 LightRAG: Plaintext Passwords Compared Without Constant-Time Function

LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, verifypassword in lightrag/api/passwords.py compares plaintext AUTHACCOUNTS password values with Python's == operator. The comparison can return after the first mismatching byte, creating response-time differences...

CVE-2024-5124 Timing Attack Vulnerability in gaizhenbiao/chuanhuchatgpt

A timing attack vulnerability exists in the gaizhenbiao/chuanhuchatgpt repository, specifically within the password comparison logic. The vulnerability is present in version 20240310 of the software, where passwords are compared using the '=' operator in Python. This method of comparison allows a...