← Back

CVE-2024-12776

nvd nist
Published: Mar 20, 2025Modified: Jun 17, 2026

JSON object

Loading...
8.1
Vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitability: 2.2 / Impact: 5.9
Source: security@huntr.dev (Secondary)

Description

In langgenius/dify v0.10.1, the `/forgot-password/resets` endpoint does not verify the password reset code, allowing an attacker to reset the password of any user, including administrators. This vulnerability can lead to a complete compromise of the application.

Affected (1)

Products: Langgenius: Dify
Langgenius
1 product
Dify
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Dify
Version 0.10.1

Related CWEs

CWE-305
Authentication Bypass by Primary Weakness
The authentication algorithm is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication error.

References (1)

Source: security@huntr.dev
ExploitThird Party Advisory

Timeline

No history available yet.