LightRAG’s POST /login endpoint fails to enforce any rate limiting, account lockout, or delay on failed authentication attempts. This missing safeguard enables an attacker on the network to submit password guesses at full request speed until a valid credential is discovered. Once a valid account is compromised, the attacker gains authenticated access to documents, the knowledge graph, and administrative functionality. The vulnerability is recorded as a high‑severity flaw with a CVSS score of 9.1.

All installations of LightRAG using a version earlier than 1.5.5 are impacted. The vulnerability exists in the file lightrag/api/lightrag_server.py, specifically on the /login POST endpoint.

The CVSS score of 9.1 indicates a high impact risk, and although no EPSS score is available, the lack of any request throttling provides a viable attack surface for brute‑force credential guessing. The issue is not listed in the CISA KEV catalog, but the potential for rapid credential compromise warrants immediate attention. The likely attack vector is a network attacker who can repeatedly hit the login endpoint, iterating over a password list until access is achieved.