What’s Vulnerable › Vulnerabilities

CVE-2024-1729: Timing Attack Vulnerability in gradio-app/gradio

• Severity: medium (CVSS 5.9 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2024-03-29 · updated 2026-06-17
• Weakness: CWE-367

Description

A timing attack vulnerability exists in the gradio-app/gradio repository, specifically within the login function in routes.py. The vulnerability arises from the use of a direct comparison operation (`app.auth[username] == password`) to validate user credentials, which can be exploited to guess passwords based on response times. Successful exploitation of this vulnerability could allow an attacker to bypass authentication mechanisms and gain unauthorized access.

Affected products

• gradio-app gradio: from 4.18.0 before 4.19.2 — fixed in 4.19.2

How to fix

Upgrade to a fixed version: gradio-app gradio 4.19.2. Check the vendor advisory for mitigations.

References

• https://github.com/gradio-app/gradio/commit/e329f1fd38935213fe0e73962e8cbd5d3af6e87b
• https://huntr.com/bounties/f6a10a8d-f538-4cb7-9bb2-85d9f5708124
• https://github.com/gradio-app/gradio/commit/e329f1fd38935213fe0e73962e8cbd5d3af6e87b
• https://huntr.com/bounties/f6a10a8d-f538-4cb7-9bb2-85d9f5708124

Get alerted when CVE-2024-1729 or the next vulnerability affects your stack