The bug is a timing side‑channel in LightRAG’s password verification. Prior to version 1.5.5, the code compared stored plaintext passwords to user input with Python's == operator, which can terminate early on the first mismatching byte. This creates measurable differences in response time that reveal how many leading bytes of the password match the supplied reference. An attacker can exploit this oracle to recover a plaintext‑configured password one character at a time. The impact is the disclosure of credentials that are stored in cleartext, potentially giving the attacker full access to the associated account and the system as a whole.

The vulnerability affects the LightRAG application produced by HKUDS. Any deployed instance running a version earlier than 1.5.5 is vulnerable. Accounts that store passwords as bcrypt‑prefixed values are not impacted because they do not use the insecure comparison path. Deployments that use plain‑text stored passwords or other non‑bcrypt hashes are exposed.

The CVSS score of 5.9 indicates moderate severity. EPSS data is not available, and the issue is not listed in the CISA KEV catalog. The attack vector can be inferred as a network‑based attack: a remote attacker who can reach the /login endpoint with low latency can repeatedly query it and measure response times to narrow down the correct password. The flaw does not require any privileged access or local code execution; it simply leverages the timing difference during authentication.