Medium severity5.9NVD Advisory· Published Mar 29, 2024· Updated Jun 17, 2026
CVE-2024-1729
CVE-2024-1729
Description
A timing attack vulnerability exists in the gradio-app/gradio repository, specifically within the login function in routes.py. The vulnerability arises from the use of a direct comparison operation (app.auth[username] == password) to validate user credentials, which can be exploited to guess passwords based on response times. Successful exploitation of this vulnerability could allow an attacker to bypass authentication mechanisms and gain unauthorized access.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
gradioPyPI | < 4.19.2 | 4.19.2 |
Affected products
3- Range: unspecified
Patches
Vulnerability mechanics
References
6- github.com/gradio-app/gradio/commit/e329f1fd38935213fe0e73962e8cbd5d3af6e87bnvdPatchWEB
- huntr.com/bounties/f6a10a8d-f538-4cb7-9bb2-85d9f5708124nvdExploitThird Party AdvisoryWEB
- github.com/advisories/GHSA-hmx6-r76c-85g9ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2024-1729ghsaADVISORY
- github.com/gradio-app/gradio/releases/tag/gradio%404.19.2ghsaWEB
- github.com/gradio-app/gradio/security/advisories/GHSA-hmx6-r76c-85g9ghsaWEB
News mentions
0No linked articles in our index yet.