CVE-2024-12776 Authentication Bypass in langgenius/dify

High 8.1 Published 20 Mar 2025 Updated 20 Mar 2025

Attackers can bypass password reset verification to take over any user account, including administrators, in the Dify application.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2024-12776?

CVE-2024-12776 is a high-severity authentication bypass vulnerability in langgenius/dify, published on 20 Mar 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

In langgenius/dify v0.10.1, the `/forgot-password/resets` endpoint does not verify the password reset code, allowing an attacker to reset the password of any user, including administrators. This vulnerability can lead to a complete compromise of the application.

Weakness: CWE-305

Which versions are affected by CVE-2024-12776?

It affects 1 product.

Products include Langgenius Dify.

How do I fix CVE-2024-12776?

No fix has been published for CVE-2024-12776 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2024-12776 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-12776 exists.

Sources

Also known as GHSA-g394-qpx6-x7rr.