https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 09 Oct 2026 03:14:58 +0000 https://cve.radiocsirt.org/vuln/cve-2026-39413 <p><strong>Affected:</strong> HKUDS LightRAG</p> <p>LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.4.14, the LightRAG API is vulnerable to a JWT algorithm confusion attack where an attacker can forge tokens by specifying &#39;alg&#39;: &#39;none&#39; in the JWT header. Since the jwt.decode() call does not explicitly deny the &#39;none&#39; algorithm, a crafted token without a signature will be accepted as valid, leading to unauthorized access. This vulnerability is fixed in 1.4.14.</p> <p><strong>Affected:</strong> HKUDS LightRAG</p> <p>LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.4.14, the LightRAG API is vulnerable to a JWT algorithm confusion attack where an attacker can forge tokens by specifying &#39;alg&#39;: &#39;none&#39; in the JWT header. Since the jwt.decode() call does not explicitly deny the &#39;none&#39; algorithm, a crafted token without a signature will be accepted as valid, leading to unauthorized access. This vulnerability is fixed in 1.4.14.</p> https://cve.radiocsirt.org/vuln/cve-2026-39413