CVE-2024-12776
Authentication Bypass in langgenius/dify
Summary
Authentication Bypass in langgenius/dify
Original description
The description as published by the source.
In langgenius/dify v0.10.1, the /forgot-password/resets endpoint does not verify the password reset code, allowing an attacker to reset the password of any user, including administrators. This vulnerability can lead to a complete compromise of the application.
References
- advisory github.com
- advisory nvd.nist.gov
- web huntr.com