CVE-2024-12039: Langgenius Dify Auth Bypass Vulnerability

CVE-2024-12039 Overview

CVE-2024-12039 affects langgenius/dify version v0.10.1, an open-source large language model (LLM) application development platform. The vulnerability stems from missing rate limiting on the password reset endpoint. Attackers can brute-force the six-digit verification code sent during password recovery. An unauthenticated adversary can iterate through the code space within hours and take over owner, admin, or standard user accounts. Successful exploitation results in full compromise of the Dify instance. The issue is classified under CWE-307: Improper Restriction of Excessive Authentication Attempts.

Critical Impact
Unauthenticated attackers can hijack administrator accounts through brute-force guessing of the six-digit password reset code, leading to complete application compromise.

Affected Products

langgenius/dify version v0.10.1
Dify Node.js deployments matching cpe:2.3:a:langgenius:dify:0.10.1
Self-hosted Dify installations exposing the password reset flow

Discovery Timeline

2025-03-20 - CVE-2024-12039 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-12039

Vulnerability Analysis

Dify implements password reset by emailing users a six-digit numeric verification code. The reset endpoint accepts the code and a new password, but it does not enforce a maximum attempt threshold, lockout window, or exponential backoff. The total code space is only 1,000,000 possibilities. An attacker automating HTTP requests can exhaust that space in hours, depending on network latency and any server-side throughput limits. Because the flow does not require prior authentication, adversaries only need a valid target email address. Any account, including the owner and administrator roles, can be hijacked once the correct code is submitted.

Root Cause

The root cause is the absence of anti-automation controls on the password reset verification handler. Neither per-account attempt counters, per-IP throttling, nor CAPTCHA challenges are applied. The verification code entropy of roughly 20 bits is insufficient on its own and requires rate limiting to remain secure, which the vulnerable release does not provide.

Attack Vector

The attack is remote and network-based. An attacker initiates a password reset for a known Dify account, then repeatedly submits reset requests cycling through six-digit codes until one succeeds. The attacker then sets a new password and authenticates as the victim. See the Huntr Bug Bounty Report for the disclosure details.

No verified proof-of-concept code is publicly indexed. The exploitation pattern in prose: the attacker sends an initial POST to the forgot-password endpoint, then loops submissions against the reset-verification endpoint with incrementing codes until the response indicates success.

Detection Methods for CVE-2024-12039

Indicators of Compromise

High-volume POST requests to Dify password reset verification endpoints from a single source IP or distributed IP pool
Sequential or randomized six-digit values submitted as the code parameter within a short time window
Password reset completion events immediately followed by administrator logins from previously unseen IP addresses
Multiple failed reset verifications targeting the same account email

Detection Strategies

Alert on more than a small threshold (for example, 10) of password reset verification failures per account within one hour
Correlate password reset success events with subsequent role or permission changes performed by the affected account
Baseline normal password reset request volume and flag statistical anomalies

Monitoring Recommendations

Enable verbose logging on Dify authentication and account recovery endpoints and forward logs to a centralized SIEM
Monitor web application firewall (WAF) telemetry for repetitive requests to reset routes
Track administrator session creation events and review any that follow a recent password reset

How to Mitigate CVE-2024-12039

Immediate Actions Required

Upgrade Dify to a release later than v0.10.1 that enforces rate limiting on password reset
Force a password reset for all owner and administrator accounts if the instance ran the vulnerable version while exposed to the internet
Restrict access to the Dify web interface behind a VPN or IP allowlist until patched
Review recent password reset and account modification audit logs for suspicious activity

Patch Information

No vendor advisory URL is available in the NVD record. Users should track the Huntr Bug Bounty Report and the langgenius/dify GitHub repository for fixed releases and upgrade beyond version 0.10.1.

Workarounds

Place a reverse proxy or WAF in front of Dify and enforce rate limits on password reset endpoints, for example five attempts per account per hour
Add CAPTCHA challenges to the password reset flow via an intermediate proxy where feasible
Temporarily disable self-service password reset and require manual administrator resets
Rotate credentials and audit user roles after applying mitigations

bash

# Example nginx rate limit for Dify password reset endpoints
limit_req_zone $binary_remote_addr zone=dify_reset:10m rate=5r/m;

server {
    location ~* /console/api/(forgot-password|reset-password) {
        limit_req zone=dify_reset burst=3 nodelay;
        proxy_pass http://dify_backend;
    }
}