CVE-2025-6386: lollms Package Vulnerable to Timing Attack in User Authentication
Summary
CVE-2025-6386: The parisneo/lollms repository is affected by a timing attack vulnerability in the authenticate_user function within the lollms_authentication.py file. Affects lollms versions < 11.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The lollms package is a Python library designed for large language model applications, providing functionalities for user authentication and interaction with language models. It is widely used in applications requiring secure user access and management. However, it has been found to be vulnerable to a timing attack, which can compromise user credentials.
Vulnerability Detail
The vulnerability arises from the authenticate_user function in the lollms_authentication.py file, where Python's default string equality operator is used for password comparison. This method compares characters sequentially and exits on the first mismatch, leading to variable response times based on the number of matching initial characters. Attackers can exploit this timing discrepancy to enumerate valid usernames and incrementally guess passwords, posing a significant security risk.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, consider implementing a constant-time comparison function for password verification. Here is an example of how you can implement this in Python:
import hmac
def constant_time_compare(val1, val2):
return hmac.compare_digest(val1, val2)
Use this function instead of the default equality operator for password checks.
Conclusion
The lollms package is vulnerable to a timing attack that can compromise user authentication. It is crucial to update to the patched version to mitigate this risk. Implementing constant-time comparison functions can also serve as a temporary workaround while ensuring the security of user credentials.
See every vulnerability recorded for lollms →
FAQ
CVE-2025-6386 is a vulnerability in the lollms package that allows attackers to exploit timing discrepancies in user authentication, enabling them to guess passwords incrementally.
The timing attack works by measuring the response time of the authentication function. If the response time varies based on the number of matching characters in the password, attackers can infer correct characters and guess the password.
The potential impacts include unauthorized access to user accounts, data breaches, and compromised application security, which can lead to further exploitation.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for lollms.
