The vulnerability arises from a JWT algorithm confusion flaw in the LightRAG API. A crafted JSON Web Token can specify an algorithm value of 'none', allowing the server to accept the token without verifying a signature. This bypasses authentication and permits an attacker to perform any action that the API would normally require valid credentials for. The primary consequence is unauthorized access to the application's functionality, potentially exposing sensitive data or allowing further exploitation.

The affected product is LightRAG provided by the vendor HKUDS. Versions earlier than 1.4.14 are impacted. Any installation using a pre‑1.4.14 release is susceptible to this flaw.

With a CVSS score of 4.2 the vulnerability is considered moderate. No EPSS score is available and the vulnerability has not been listed in the CISA KEV catalog. The likely attack vector is remote, via the exposed API endpoint where an attacker can send a crafted JWT. Successful exploitation would result in bypassing authentication and gaining unauthorized access to the API.