Password Reset Code Vulnerability in Langgenius Dify
CVE-2024-12776

8.1HIGH

Key Information:

Vendor
Langgenius
Status
Langgenius/dify
Vendor
CVE Published:
20 March 2025

Summary

In version 0.10.1 of Langgenius Dify, the /forgot-password/resets endpoint lacks proper verification for password reset codes, enabling unauthorized users to reset passwords for any account, including that of administrators. This significant oversight poses a serious risk of account compromise and unauthorized access to sensitive user data within the application.

Affected Version(s)

langgenius/dify <= unspecified

References

https://huntr.com/bounties/00a8b403-7da5-431e-afa3-40339c...

CVSS V3.0

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.