CVE-2024-12039 Improper Restriction of Excessive Authentication Attempts in langgenius/dify
An unauthenticated attacker can brute-force six-digit password reset codes to take over user accounts due to missing rate limits.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-12039?
CVE-2024-12039 is a high-severity authentication bypass vulnerability in langgenius/dify, published on 20 Mar 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
langgenius/dify version v0.10.1 contains a vulnerability where there are no limits applied to the number of code guess attempts for password reset. This allows an unauthenticated attacker to reset owner, admin, or other user passwords within a few hours by guessing the six-digit code, resulting in a complete compromise of the application.
Weakness: CWE-307
Which versions are affected by CVE-2024-12039?
It affects 1 product.
Products include Langgenius Dify.
How do I fix CVE-2024-12039?
No fix has been published for CVE-2024-12039 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2024-12039 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-12039 exists.
Other vulnerabilities in langgenius/dify
Sources
Also known as GHSA-jjm2-vhrm-92vg.