CVE-2024-5124 is a high severity (CVSS 7.5) timing attack in gaizhenbiao/chuanhuchatgpt, found in version 20240310. Passwords were compared with Python's equals operator, which leaks timing between guesses. The fix commit switches to a constant time comparison, so upgrade to a build that includes it.
What's affected
The record names the gaizhenbiao/chuanhuchatgpt repository, version 20240310, where the login code compares a submitted password against the stored one with =. ChuanhuChatGPT uses date style version numbers, so versions near that date may also share the code.
The referenced commit (e46ec4e) is described in the project as replacing a list index comparison with a dictionary lookup and hmac.compare_digest, which compares in constant time. The record does not name a release number, so use the commit date as your marker and pull a build that contains it.
How to check if you're exposed
If you run it from a git checkout, test whether the fix is in your tree:
git merge-base --is-ancestor e46ec4ecd896bc3c88eb9a2f44e8593f3c6761b4 HEAD && echo fixed || echo not fixed
If you run a container or a zip download, compare its date against the commit date on the project page. Also check whether the instance is reachable from the internet and whether it uses the built in username and password list.
What to do now
- Update to a build that includes commit e46ec4e or later.
- If you cannot update, put the app behind a reverse proxy with its own authentication and keep it off the public internet.
- Rotate every password configured in the app, since a timing attack could have recovered them.
- Add rate limiting in front of the login so repeated guesses are slowed.
- Use long, random passwords so a leaked prefix is of little help.
Why it matters
The class is CWE-203, an observable discrepancy. String equality in most languages stops at the first mismatched character, so a guess that matches more leading characters takes slightly longer. An attacker who can measure those differences over many requests can narrow the secret one position at a time.
In practice network jitter makes this hard, which is why the advisory says the attacker could potentially guess passwords. Still, it is a known cause of real breaks, and the repair is a one line change to a constant time function. The record does not set the KEV flag.
Quick check
Why does an equals check leak anything?
It returns as soon as a character differs, so the time taken depends on how much of the guess is right.
What is the right comparison to use?
A constant time function such as hmac.compare_digest in Python, which is what the fix commit uses.
Sources
Last reviewed: 19 October 2026.
