PT-2025-12146 · Langgenius · Dify

Published 2025-03-20 · Updated 2025-07-14 · CVE-2024-12776

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions langgenius/dify version 0.10.1

Description The issue concerns the /forgot-password/resets endpoint, which does not verify the password reset code. This allows an attacker to reset the password of any user, including administrators, potentially leading to a complete compromise of the application.

Recommendations For langgenius/dify version 0.10.1, consider disabling the /forgot-password/resets endpoint until a patch is available to prevent unauthorized password resets. Restrict access to this endpoint to minimize the risk of exploitation. Avoid using the password reset functionality in the affected endpoint until the issue is resolved.

Exploit

Fix

Weakness Enumeration

CWE-305

Related Identifiers

CVE-2024-12776

Affected Products

Dify

References · 5

• 🔥 https://huntr.com/bounties/00a8b403-7da5-431e-afa3-40339cf734bf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-12776 · Security Note
• https://osv.dev/vulnerability/CVE-2024-12776 · Vendor Advisory
• https://t.me/cvenotify/128906 · Telegram Post
• https://twitter.com/CVEnew/status/1902671082206953664 · Twitter Post