CVE-2026-72917 AnythingLLM: Password recovery accepts one recovery code twice after whitespace normalization
An attacker can bypass password recovery checks by submitting a single valid code twice with whitespace variations, leading to account takeover.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-72917?
CVE-2026-72917 is a medium-severity authentication bypass vulnerability in Mintplex-Labs anything-llm, published on 10 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. From 1.0.0 to 1.15.0, AnythingLLM's unauthenticated account-recovery flow in server/utils/PasswordRecovery/index.js uses recoverAccount() to deduplicate the raw recoveryCodes values before trimming them, so one valid code submitted twice with different surrounding whitespace can satisfy the two-code check. Each normalized value can also match the same stored hash instead of consuming a distinct hash. An attacker who knows the target username and one recovery code can call POST /api/system/recover-account in multi-user mode, receive a password-reset token, and use POST /api/system/reset-password to take over the account, including an administrator account.
Which versions are affected by CVE-2026-72917?
How do I fix CVE-2026-72917?
Apply the vendor's patch.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-72917 being exploited?
There is no known exploitation of CVE-2026-72917 in the wild and no public exploit code.
Sources
Also known as GHSA-vv8w-wg6r-hq56, MINI-qcmw-w26w-632p.