lightrag-hku: Plaintext Passwords Compared Without Constant-Time Function

Summary When plaintext passwords are stored in AUTHACCOUNTS, the comparison uses Python's == operator which is not constant-time. An attacker with low-latency access can exploit timing differences to recover the password character by character. Details python lightrag/api/passwords.py:13-26 def...

CVE-2026-85725

LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, verifypassword in lightrag/api/passwords.py compares plaintext AUTHACCOUNTS password values with Python's == operator. The comparison can return after the first mismatching byte, creating response-time differences...

CVE-2026-85725 LightRAG: Plaintext Passwords Compared Without Constant-Time Function

LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, verifypassword in lightrag/api/passwords.py compares plaintext AUTHACCOUNTS password values with Python's == operator. The comparison can return after the first mismatching byte, creating response-time differences...

Fedora 10 : python-fedora-0.3.9-1.fc10 (2009-1518)

This release includes a bugfix to the fedora.client.AccountSystem.verifypassword method. verifypassword was incorrectly returning True username, password combination was correct for any input. Although no known code is using this method to verify a user's account with the Fedora Account System, t...

Fedora Core 10 FEDORA-2009-1518 (python-fedora)

The remote host is missing an update to python-fedora announced via advisory FEDORA-2009-1518. Note: This VT has been deprecated and is therefore no longer functional. SPDX-FileCopyrightText: 2009 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C...