langgenius/dify version v0.10.1 contains a vulnerability where there are no limits applied to the number of code guess attempts for password reset. This allows an unauthenticated attacker to reset owner, admin, or other user passwords within a few hours by guessing the six-digit code, resulting in a complete compromise of the application.
References
| Link | Resource |
|---|---|
| https://huntr.com/bounties/61af30d5-6055-4c6c-8a55-3fa43dada512 | Exploit Third Party Advisory |
Configurations
History
15 Jul 2025, 15:59
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Langgenius dify
Langgenius |
|
| References | () https://huntr.com/bounties/61af30d5-6055-4c6c-8a55-3fa43dada512 - Exploit, Third Party Advisory | |
| CPE | cpe:2.3:a:langgenius:dify:0.10.1:*:*:*:*:node.js:*:* | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.1 |
20 Mar 2025, 10:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-03-20 10:15
Updated : 2025-07-15 15:59
NVD link : CVE-2024-12039
Mitre link : CVE-2024-12039
JSON object : View
Products Affected
langgenius
- dify
CWE
CWE-307
Improper Restriction of Excessive Authentication Attempts