JWT Algorithm Confusion Vulnerability in LightRAG API by HKUDS
CVE-2026-39413

4.2MEDIUM

Key Information:

Vendor

Hkuds

Status
Lightrag
Vendor
CVE Published:
8 April 2026

What is CVE-2026-39413?

The LightRAG API, developed by HKUDS, contains a vulnerability that allows attackers to exploit JWT (JSON Web Tokens) by using the 'alg': 'none' header in crafted tokens. This flaw arises because the jwt.decode() function does not sufficiently validate the algorithm, allowing unauthorized access through tokens that lack a valid signature. This security risk was present in versions prior to 1.4.14 and has been addressed in recent updates.

Affected Version(s)

LightRAG < 1.4.14

References

https://github.com/HKUDS/LightRAG/security/advisories/GHS...
x_refsource_CONFIRM

CVSS V3.1

Score:
4.2
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
High
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.