AIKIDO-2026-320704

TL;DR

The POST /login endpoint in lightrag/api/lightrag_server.py performs no rate limiting, account lockout, backoff, or attempt counting on failed authentication. A network-reachable client can submit unlimited password guesses at full network speed against configured accounts. Once credentials are recovered, the client gains full authenticated access to all documents, the knowledge graph, and administrative operations. The fix adds a login rate limiter that throttles repeated failed attempts.