Password Reset Code Vulnerability in Langgenius Dify
CVE-2024-12776
8.1HIGH
What is CVE-2024-12776?
In version 0.10.1 of Langgenius Dify, the /forgot-password/resets
endpoint lacks proper verification for password reset codes, enabling unauthorized users to reset passwords for any account, including that of administrators. This significant oversight poses a serious risk of account compromise and unauthorized access to sensitive user data within the application.
Affected Version(s)
langgenius/dify <= unspecified