Account compromise via unrestricted password guessing

Improper restriction of login attempts in LightRAG before 1.5.5 allows remote attackers to brute-force configured account passwords. The POST /login handler passes every submitted username and password directly to password verification without a rate limit, delay, failure counter, or lockout. Authentication must be configured and a password must be guessed successfully; recovered credentials grant access to protected data and administrative operations.