AIKIDO-2026-320704
lightrag-hku is vulnerable to Improper Restriction of Excessive Authentication Attempts
75
High Risk
This Affects:
lightrag-hkuTL;DR
The POST /login endpoint in lightrag/api/lightrag_server.py performs no rate limiting, account lockout, backoff, or attempt counting on failed authentication. A network-reachable client can submit unlimited password guesses at full network speed against configured accounts. Once credentials are recovered, the client gains full authenticated access to all documents, the knowledge graph, and administrative operations. The fix adds a login rate limiter that throttles repeated failed attempts.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you configure AUTH_ACCOUNTS so that the /login endpoint authenticates users.
Background info
lightrag-hku is vulnerable to Improper Restriction of Excessive Authentication Attempts in versions 1.4.0 - 1.5.4.
How to fix this
Upgrade the lightrag-hku library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant