PT-2025-28157 · Parisneo · Lollms

Published 2025-03-23 · Updated 2025-07-07 · CVE-2025-6386

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions: parisneo/lollms versions prior to 20.1

Description: The issue arises from a timing attack vulnerability in the authenticate user function within the lollms authentication.py file. This vulnerability allows attackers to enumerate valid usernames and guess passwords incrementally by analyzing response time differences. The vulnerability is caused by the use of Python's default string equality operator for password comparison, which compares characters sequentially and exits on the first mismatch, leading to variable response times based on the number of matching initial characters.

Recommendations: For versions prior to 20.1, update to version 20.1 to resolve the issue. As a temporary workaround, consider modifying the authenticate user function to use a constant-time string comparison method to prevent variable response times based on password matches.

Fix

Side Channel Attack

Weakness Enumeration

CWE-203

Related Identifiers

BDU:2026-00093

CVE-2025-6386

GHSA-J5PR-VRJJ-9V4H

Affected Products

Lollms

References · 10

• https://osv.dev/vulnerability/GHSA-j5pr-vrjj-9v4h · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-6386 · Security Note
• https://bdu.fstec.ru/vul/2026-00093 · Security Note
• https://osv.dev/vulnerability/CVE-2025-6386 · Vendor Advisory
• https://github.com/gaizhenbiao/chuanhuchatgpt/commit/e46ec4ecd896bc3c88eb9a2f44e8593f3c6761b4 · Note
• https://github.com/ParisNeo/lollms · Note
• https://github.com/parisneo/lollms/commit/f78437f7b5aa39a78c6201912faf4e0645a38c48 · Note
• https://twitter.com/CVEnew/status/1942166383015399559 · Twitter Post
• https://huntr.com/bounties/6da05485-d219-4f18-9ffc-991053524b67 · Note
• https://twitter.com/VulmonFeeds/status/1942199547750461618 · Twitter Post