CVE-2024-1729

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-1729
A timing attack vulnerability exists in the gradio-app/gradio repository, specifically within the login function in routes.py. The vulnerability arises from the use of a direct comparison operation (`app.auth[username] == password`) to validate user credentials, which can be exploited to guess passwords based on response times. Successful exploitation of this vulnerability could allow an attacker to bypass authentication mechanisms and gain unauthorized access.
CVSS

No CVSS.

References
Link Resource
https://github.com/gradio-app/gradio/commit/e329f1fd38935213fe0e73962e8cbd5d3af6e87b Patch
https://github.com/gradio-app/gradio/commit/e329f1fd38935213fe0e73962e8cbd5d3af6e87b Patch
https://huntr.com/bounties/f6a10a8d-f538-4cb7-9bb2-85d9f5708124 Exploit Third Party Advisory
https://huntr.com/bounties/f6a10a8d-f538-4cb7-9bb2-85d9f5708124 Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:gradio_project:gradio:*:*:*:*:*:python:*:*
History

30 Jul 2025, 12:43

Type Values Removed Values Added
References () https://huntr.com/bounties/f6a10a8d-f538-4cb7-9bb2-85d9f5708124 - () https://huntr.com/bounties/f6a10a8d-f538-4cb7-9bb2-85d9f5708124 - Exploit, Third Party Advisory
References () https://github.com/gradio-app/gradio/commit/e329f1fd38935213fe0e73962e8cbd5d3af6e87b - () https://github.com/gradio-app/gradio/commit/e329f1fd38935213fe0e73962e8cbd5d3af6e87b - Patch
CWE CWE-367
First Time Gradio Project
Gradio Project gradio
CPE cpe:2.3:a:gradio_project:gradio:*:*:*:*:*:python:*:*

16 Apr 2024, 12:15

Type Values Removed Values Added
Summary Th password check condition is vulnerable to timing attack to guess the password A timing attack vulnerability exists in the gradio-app/gradio repository, specifically within the login function in routes.py. The vulnerability arises from the use of a direct comparison operation (`app.auth[username] == password`) to validate user credentials, which can be exploited to guess passwords based on response times. Successful exploitation of this vulnerability could allow an attacker to bypass authentication mechanisms and gain unauthorized access.

29 Mar 2024, 05:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-03-29 05:15

Updated : 2025-07-30 12:43

NVD link : CVE-2024-1729

Mitre link : CVE-2024-1729

JSON object : View

Products Affected

gradio_project

  • gradio
CWE

No CWE.