CVE-2024-5124

CVE-2024-5124 is a high-severity timing attack vulnerability affecting gaizhenbiao/chuanhuchatgpt version 20240310. The flaw resides in the password comparison logic, where the use of the '=' operator in Python allows attackers to infer password characters based on response times. This enables an unauthenticated attacker to potentially guess user passwords and compromise system security. While no active exploitation or public exploit code is currently reported, its high CVSS score of 7.5 and high EPSS score indicate a significant risk, despite minimal community discussion or media coverage.