CVE-2024-12039
Improper Restriction of Excessive Authentication Attempts in langgenius/dify
- State
- Published
- Severity
- 7.4 High
- Published
- Mar 20, 2025
- Updated
- Mar 20, 2025
- Reserved
- Dec 2, 2024
Description
langgenius/dify version v0.10.1 contains a vulnerability where there are no limits applied to the number of code guess attempts for password reset. This allows an unauthenticated attacker to reset owner, admin, or other user passwords within a few hours by guessing the six-digit code, resulting in a complete compromise of the application.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.0 | 7.4 High | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N | @huntr_ai |
Weaknesses
- CWE-307 Improper Restriction of Excessive Authentication Attempts
Affected Products
| Product | Versions |
|---|---|
langgenius/difylanggenius |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.