Race Condition in Lumiverse AI Chat Application by Prolix

CVE-2026-44443

What is CVE-2026-44443?

Lumiverse, an AI chat application developed by Prolix, contains a race condition vulnerability prior to version 0.9.7. This flaw pertains to the consumeNonce() function, which inadequately validates incoming HTTP request values and fails to bind the nonce to the administrator's session. Consequently, if an attempt to register a user fails due to existing duplicate emails, the nonce remains set but becomes unconsumed. Exploiting this weakness allows an attacker to race against the 10-second window during which a valid nonce is active, enabling them to register unauthorized accounts by sending POST requests to the email signup endpoint. This issue has been addressed in version 0.9.7.

References