SeverityMODERATE
RepositoryHKUDS/LightRAG
PublishedApr 8, 2026, 12:17 AM
Ref9944ce1cd1b3c3a951db3ac4c907169358004fca
Advisory summary
lightrag-hku: JWT Algorithm Confusion Vulnerability
Curator analysis
Synopsis
JWT algorithm confusion in LightRAG authentication: the auth handler accepts a configured JWT algorithm without rejecting 'none', and token validation passes that algorithm into jwt.decode(), enabling unsigned token acceptance when the insecure algorithm is used.
Vulnerability classes
jwt algorithm confusionauthentication bypass
Sink hints
lightrag/api/auth.py
This file contains both the JWT algorithm initialization and the validate_token decode sink that the fix hardens against use of the 'none' algorithm.
Expected components
AuthHandler.__init__AuthHandler.validate_tokenJWT algorithm configurationJWT decode path
Model scores(5)
openai/gpt-5.4excellent
91.00View trace
Target Alignment
26
Source To Sink Reasoning
29
Impact And Exploitability
18
Evidence Quality
8
Overclaim Control
10
anthropic/claude-opus-4.6excellent
84.00View trace
Target Alignment
0.82
Source To Sink Reasoning
0.92
Impact And Exploitability
0.78
Evidence Quality
0.8
Overclaim Control
0.7
google/gemini-3.1-pro-previewpartial
74.00View trace
Target Alignment
23
Source To Sink Reasoning
24
Impact And Exploitability
15
Evidence Quality
7
Overclaim Control
5
z-ai/glm-5.1partial
72.00View trace
Target Alignment
25
Source To Sink Reasoning
23
Impact And Exploitability
12
Evidence Quality
8
Overclaim Control
4
moonshotai/kimi-k2.5partial
68.00View trace
Target Alignment
24
Source To Sink Reasoning
21
Impact And Exploitability
11
Evidence Quality
8
Overclaim Control
4