LightRAG, a retrieval‑augmented generation framework, contained an authentication bypass that allowed a remote attacker to access protected services without credentials. By default, the system falls back to a hardcoded secret when LIGHTRAG_API_KEY is set but AUTH_ACCOUNTS is unset, enabling guest JSON Web Tokens to be minted from public /auth‑status and /login endpoints. The combined_dependency function accepts these guest tokens before checking the API key, giving an unauthenticated user the ability to call any endpoint protected by combined_auth, including document read, upload, deletion, graph mutation, and query operations. This bug represents a classic authentication bypass (CWE‑287) coupled with an exposed hard‑coded credential (CWE‑798).

Vendors: HKUDS; Product: LightRAG. Systems running any version of LightRAG prior to 1.5.4 where the environment variable LIGHTRAG_API_KEY is configured but AUTH_ACCOUNTS is not set are vulnerable. Deployments of LightRAG 1.5.4 or newer have the fix applied.

The vulnerability scores a CVSS of 9.3, indicating a severe impact if exploited. The EPSS score is less than 1%, suggesting that exploitation is currently unlikely, and the vulnerability is not listed in CISA’s KEV catalogue. An attacker can exploit the issue remotely over HTTP from any network that can reach the service, without requiring authentication. The high base score and widespread endpoint exposure mean that, if the flaw were actively exploited, an attacker could read, modify, or delete data stored in the system. Given the low EPSS, the immediate risk is moderate, but the severity of potential impact warrants timely mitigation.