CVE-2024-1729 json
Timing Attack Vulnerability in gradio-app/gradio
published 2024-02-22 2 y ago modified 2026-09-10 1 mo ago also GHSA-hmx6-r76c-85g9 , PYSEC-2026-1416 , EUVD-2024-0655
- cvss
- 5.9
- version 3.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 43%
- public exploits
- 0
- none known
Summary
A timing attack vulnerability exists in the gradio-app/gradio repository, specifically within the login function in routes.py. The vulnerability arises from the use of a direct comparison operation (`app.auth[username] == password`) to validate user credentials, which can be exploited to guess passwords based on response times. Successful exploitation of this vulnerability could allow an attacker to bypass authentication mechanisms and gain unauthorized access.
Patch / fix
- pypi gradio 4.19.2
- gradio-app gradio-app/gradio 4.19.2
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- total
- Assessed
- 2 y ago
Exploit prediction
0.50% chance of exploitation in the next 30 days, higher than 43% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- huntr.com https://huntr.com/bounties/f6a10a8d-f538-4cb7-9bb2-85d9f5708124 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.0 | 5.9 | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N |
| OSV | 3.0 | 5.9 | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N |
| GitHub | 3.0 | 5.9 | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | gradio | <4.19.2 |
4.19.2 |
Affected products
- gradio-app gradio-app/gradio
- gradio_project gradio
Classification
- Weakness
-
- CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition
References
-
github.com
/gradio-app/gradio/commit/e329f1fd38935213fe0e73962e8cbd5d3af6e87b
web, patch
-
huntr.com
/bounties/f6a10a8d-f538-4cb7-9bb2-85d9f5708124
web, exploit, third-party-advisory
-
github.com
/gradio-app/gradio/security/advisories/GHSA-hmx6-r76c-85g9
web
-
nvd.nist.gov
/vuln/detail/CVE-2024-1729
advisory
-
github.com
/gradio-app/gradio
package
-
github.com
/gradio-app/gradio/releases/tag/gradio%404.19.2
web
-
pypi.org
/project/gradio
package
-
github.com
/advisories/GHSA-hmx6-r76c-85g9
advisory
Sources
- CVE List CVE-2024-1729
- GitHub Advisory GHSA-hmx6-r76c-85g9
- NVD CVE-2024-1729
- OSV PYSEC-2026-1416
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.