CVE-2024-12776
Authentication Bypass in langgenius/dify
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
Authentication Bypass in langgenius/dify
In langgenius/dify v0.10.1, the `/forgot-password/resets` endpoint does not verify the password reset code, allowing an attacker to reset the password of any user, including administrators. This vulnerability can lead to a complete compromise of the application.
Reserved 2024-12-18 | Published 2025-03-20 | Updated 2025-03-20 | Assigner @huntr_aiCWE-305 Authentication Bypass by Primary Weakness
huntr.com/bounties/00a8b403-7da5-431e-afa3-40339cf734bf
Support options
