CVE-2024-12776

🗓️ 20 Mar 2025 10:10:42Reported by @huntr_aiType

cve🔗 web.nvd.nist.gov👁 53 Views🌐 WEB

Critical vulnerability in langgenius/dify allowing unauthorized password resets for all users.

Reporter	Title	Published	Views	Family All 8
Huntr	Admin user account takeover due to password reset code not being checked on the backend	25 Oct 202404:34	–	huntr
CNNVD	dify 安全漏洞	20 Mar 202500:00	–	cnnvd
Cvelist	CVE-2024-12776 Authentication Bypass in langgenius/dify	20 Mar 202510:10	–	cvelist
EUVD	EUVD-2025-7010	3 Oct 202520:07	–	euvd
NVD	CVE-2024-12776	20 Mar 202510:15	–	nvd
Positive Technologies	PT-2025-12146 · Langgenius · Dify	20 Mar 202500:00	–	ptsecurity
RedhatCVE	CVE-2024-12776	22 Mar 202512:30	–	redhatcve
Vulnrichment	CVE-2024-12776 Authentication Bypass in langgenius/dify	20 Mar 202510:10	–	vulnrichment

NVD

Node

langgenius difyMatch0.10.1node.js

[
  {
    "vendor": "langgenius",
    "product": "langgenius/dify",
    "versions": [
      {
        "version": "unspecified",
        "status": "affected",
        "versionType": "custom",
        "lessThanOrEqual": "latest"
      }
    ]
  }
]

Source	Link
huntr	www.huntr.com/bounties/00a8b403-7da5-431e-afa3-40339cf734bf

Parameter	Position	Path	Description	CWE
code	request body	/forgot-password/resets	Password reset endpoint does not verify the reset code, enabling an attacker to reset the password of any user.	CWE-305
password	request body	/forgot-password/resets	Password reset endpoint does not verify the reset code, enabling an attacker to reset the password of any user.	CWE-305

14 Jul 2025 18:18Current

8.1High risk

Vulners AI Score8.1

CVSS 38.1

EPSS0.002

SSVC

CWE-305