CVE-2026-85725: lightrag-hku Plaintext Passwords Timing Attack Vulnerability
Summary
CVE-2026-85725: lightrag-hku: Plaintext Passwords Compared Without Constant-Time Function. Affects lightrag-hku versions < 1.5.5. Fixed in 1.5.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
lightrag-hku is an open-source Python package designed for building lightweight web applications. It provides functionalities for user authentication, including password management. However, it has a critical vulnerability related to how it handles plaintext passwords, which can lead to security breaches if not addressed.
Vulnerability Detail
The vulnerability arises from the use of Python's '==' operator for comparing plaintext passwords stored in AUTH_ACCOUNTS. This comparison is not constant-time, meaning that an attacker with low-latency access can exploit timing discrepancies to recover passwords character by character. The observable timing differences can reveal both the length of the password and individual characters, making it easier for attackers to compromise accounts without triggering brute-force limits.
How To Fix
Latest published version: 1.5.7 as of 23 Oct 2026
pip install --upgrade "lightrag-hku==1.5.7"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.5.5
This is the first release that contains the fix.
pip install --upgrade "lightrag-hku==1.5.5"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using plaintext passwords in AUTH_ACCOUNTS. Instead, utilize hashed passwords with a secure hashing algorithm such as bcrypt, which is already supported by the package. Ensure that any password verification uses the bcrypt.checkpw function, which operates in constant time.
Conclusion
The lightrag-hku package has a significant vulnerability related to the comparison of plaintext passwords, which can be exploited by attackers. It is crucial to update to the latest version to ensure security or implement workarounds to mitigate risks. Regular monitoring for vulnerabilities using tools like Vulert can help maintain application security.
See every vulnerability recorded for lightrag-hku →
FAQ
The vulnerability allows attackers to recover plaintext passwords character by character, potentially compromising user accounts.
Any deployment of lightrag-hku that stores plaintext passwords in AUTH_ACCOUNTS is at risk.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for this vulnerability is 5.9, indicating a moderate severity level.
If an immediate update is not possible, implement the workaround by using hashed passwords instead of plaintext passwords.
References
Related vulnerabilities
Recent vulnerabilities recorded for lightrag-hku.
