CVE-2024-12776
Authentication Bypass in langgenius/dify
Résumé
Authentication Bypass in langgenius/dify
Description d'origine
La description telle que publiée par la source (souvent en anglais).
In langgenius/dify v0.10.1, the /forgot-password/resets endpoint does not verify the password reset code, allowing an attacker to reset the password of any user, including administrators. This vulnerability can lead to a complete compromise of the application.
Références
- advisory github.com
- advisory nvd.nist.gov
- web huntr.com