LightRAG versions before 1.4.14 are vulnerable to a JWT algorithm confusion attack due to improper verification of cryptographic signatures (CWE-347). Specifically, the jwt.decode() function does not explicitly reject tokens specifying 'alg': 'none' in the JWT header, allowing unsigned tokens to be accepted as valid. This flaw enables attackers to forge JWT tokens and bypass authentication controls. The issue is resolved in LightRAG version 1.4.14.

Successful exploitation allows an attacker to bypass authentication by presenting forged JWT tokens without valid signatures, leading to unauthorized access. The vulnerability does not affect integrity or availability directly but compromises confidentiality by allowing unauthorized access. There are no known exploits in the wild as of the published date.

Upgrade LightRAG to version 1.4.14 or later, where the vulnerability is fixed by explicitly rejecting tokens with the 'none' algorithm. Since no official patch link or advisory is provided, verify the upgrade from the vendor's official release notes or repository. Until upgraded, avoid accepting JWT tokens that do not have a valid signature algorithm.