CVE-2025-6386: Lollms Timing Attack Vulnerability in User Authentication
lollms, parisneo/lollms
A timing attack vulnerability in the lollms framework user authentication function allows username enumeration and password guessing. The issue stems from insecure string comparison implementation.
disclosed CVENo confirmed exploitation, so this record is tracked as a disclosed vulnerability and not counted as an incident. It moves into the counts if CISA or the vendor confirms exploitation. Why
- CVSS
- 7.5
- EPSS
- <0.01 · top 65% · 2026-11-13
- fix status
- Fix status unknown
- first report
- 7 Jul 2025
- last update
- 7 Jul 2025
- CVE ids
Timeline · 1
Sources · 1
Advisories and databases
- 2025-07-07CVE-2025-6386: Lord of Large Language Models vulnerable to Observable Discrepancy attack via authenticate_user functionGitHub Advisory Database · github.com/advisories/GHSA-j5pr-vrjj-9v4h
Titles and links belong to their publishers. The summary above is written by gcdRadar in its own words; data is CC BY-SA 4.0.
Classification
- lane
- Patch now
- AI role
- Attack on AI
- categories
- Infrastructure vulnerability
- severity
- 2 · Disclosed vulnerability
- fix status
- Fix status unknown
- targets
- Framework / tooling
- owasp llm top 10
- LLM03:2025 Supply Chain
- mitre atlas
- no technique for these categories
- dates
- happened 7 Jul 2025 · first reported 7 Jul 2025
- origin
- GitHub Advisory DatabaseVulnerability record from NVD / the GitHub Advisory Database. This product uses the NVD API but is not endorsed or certified by the NVD.
- record
- confidence 0.95 · created 2026-10-18 07:00Z · updated 2026-10-18 07:00Z
Lane, AI role, categories and severity come from the classifier; the OWASP and ATLAS rows are derived from the categories. How these are assigned
Copy a brief
This record as a short Markdown brief, for a ticket, a chat or a coding agent.
the brief as text
# CVE-2025-6386: Lollms Timing Attack Vulnerability in User Authentication https://gcdradar.vercel.app/incidents/cve-2025-6386-lollms-timing-attack-vulnerability-in-user-aut · AIR-2025-0306 · closed 2025-07-07 - Lane: Patch now - Severity: 2 (Disclosed vulnerability) - Fix status: Fix status unknown - First reported: 2025-07-07 - AI role: Attack on AI - Products: lollms, parisneo/lollms - CVE ids: CVE-2025-6386 - CVSS: 7.5 ## Summary A timing attack vulnerability in the lollms framework user authentication function allows username enumeration and password guessing. The issue stems from insecure string comparison implementation. ## What to do No action recorded; read the sources below and the vendor's advisory. ## Latest updates - 2025-07-07: CVE-2025-6386: Lord of Large Language Models vulnerable to Observable Discrepancy attack via authenticate_user function (https://github.com/advisories/GHSA-j5pr-vrjj-9v4h) ## Sources - 2025-07-07 GitHub Advisory Database: CVE-2025-6386: Lord of Large Language Models vulnerable to Observable Discrepancy attack via authenticate_user function https://github.com/advisories/GHSA-j5pr-vrjj-9v4h Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.
Related
- closed8.4LoLLMs CVE-2024-6982: LoLLMS Code Injection and Sandbox Bypass
Patch now · Disclosed · since 20 Mar 2025 · CVE-2024-6982
AI - closed9.6LoLLMs CVE-2026-1115: parisneo/lollms vulnerable to stored XSS in social feature
Patch now · Disclosed · since 10 Apr 2026 · CVE-2026-1115
AI - closed4.1LoLLMs CVE-2026-1163: parisneo/lollms insufficient session expiration vulnerability
Patch now · Disclosed · since 8 Apr 2026 · CVE-2026-1163
AI - closed7.4LoLLMs CVE-2024-5824: lollms path traversal allows config override and RCE
Patch now · Disclosed · since 27 Jun 2024 · CVE-2024-5824
AI - closed7.3LoLLMs CVE-2024-6139: lollms path traversal vulnerability in XTTS server
Patch now · Disclosed · since 27 Jun 2024 · CVE-2024-6139
AI - closed8.6LoLLMs CVE-2024-6085: Path traversal vulnerability in lollms
Patch now · Disclosed · since 27 Jun 2024 · CVE-2024-6085
AI