CVE-2026-39413: lightrag-hku: JWT Algorithm Confusion Vulnerability

April 8, 2026 (updated May 9, 2026)

The LightRAG API is vulnerable to a JWT algorithm confusion attack where an attacker can forge tokens by specifying ‘alg’: ’none’ in the JWT header. Since the jwt.decode() call does not explicitly deny the ’none’ algorithm, a crafted token without a signature will be accepted as valid, leading to unauthorized access.

References

github.com/HKUDS/LightRAG/commit/728f2e54509d93e0a44f929c7f83f2c88d6d291b
github.com/HKUDS/LightRAG/security/advisories/GHSA-8ffj-4hx4-9pgf
github.com/advisories/GHSA-8ffj-4hx4-9pgf
nvd.nist.gov/vuln/detail/CVE-2026-39413

Code Behaviors & Features

Detect and mitigate CVE-2026-39413 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →