CVE-2024-12776 — Authentication Bypass in langgenius/dify
In langgenius/dify v0.10.1, the `/forgot-password/resets` endpoint does not verify the password reset code, allowing an attacker to reset the password of any user, including adm…
Published: 2025-03-20 · CVSS: 8.1 · CVSS 3.0
In langgenius/dify v0.10.1, the `/forgot-password/resets` endpoint does not verify the password reset code, allowing an attacker to reset the password of any user, including administrators. This vulnerability can lead to a complete compromise of the application.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7