Timing Attack Vulnerability in parisneo/lollms Authentication Function

CVE-2025-6386

What is CVE-2025-6386?

The parisneo/lollms repository has a vulnerability in the authenticate_user function found in lollms_authentication.py. This timing attack allows an attacker to uncover valid usernames and incrementally guess passwords by measuring variations in response times. The issue stems from Python's default string equality operator, which processes characters sequentially and reveals discrepancies in timing based on the number of match characters. This vulnerability can be exploited effectively until patched in version 20.1.

References