CVE-2024-12776 Information

Description

In langgenius/dify v0.10.1 the /forgot-password/resets endpoint does not verify the password reset code allowing an attacker to reset the password of any user including administrators. This vulnerability can lead to a complete compromise of the application.

Reference

https://huntr.com/bounties/00a8b403-7da5-431e-afa3-40339cf734bf