PT-2025-28157 · Parisneo · Lollms
CVE-2025-6386
·
Published
2025-03-23
·
Updated
2026-07-07
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:C/I:N/A:N |
Name of the Vulnerable Software and Affected Versions:
parisneo/lollms versions prior to 20.1
Description:
The issue arises from a timing attack vulnerability in the
authenticate user function within the lollms authentication.py file. This vulnerability allows attackers to enumerate valid usernames and guess passwords incrementally by analyzing response time differences. The vulnerability is caused by the use of Python's default string equality operator for password comparison, which compares characters sequentially and exits on the first mismatch, leading to variable response times based on the number of matching initial characters.Recommendations:
For versions prior to 20.1, update to version 20.1 to resolve the issue.
As a temporary workaround, consider modifying the
authenticate user function to use a constant-time string comparison method to prevent variable response times based on password matches.Fix
Side Channel Attack
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Lollms