CVE-2024-12776: Langgenius Dify Auth Bypass Vulnerability

CVE-2024-12776 Overview

CVE-2024-12776 is an authentication bypass vulnerability in langgenius/dify version 0.10.1. The /forgot-password/resets endpoint fails to verify the password reset code before applying a new password. An unauthenticated remote attacker can reset the password of any account, including administrator accounts. Successful exploitation leads to full application compromise and takeover of the Dify instance.

The issue is tracked under CWE-305: Authentication Bypass by Primary Weakness. Dify is a widely deployed open-source LLM application development platform, which increases the exposure of unpatched instances reachable over the network.

Critical Impact
Any unauthenticated attacker with network access to a vulnerable Dify instance can take over administrator accounts and gain full control of the platform and its data.

Affected Products

langgenius/dify version 0.10.1
Dify deployments running on Node.js runtimes matching CPE cpe:2.3:a:langgenius:dify:0.10.1
Self-hosted Dify installations exposing the /forgot-password/resets endpoint

Discovery Timeline

2025-03-20 - CVE-2024-12776 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-12776

Vulnerability Analysis

Dify implements a standard password reset workflow. A user submits an email address, receives a reset code, and posts the code together with a new password to /forgot-password/resets. In version 0.10.1, the server-side handler for /forgot-password/resets accepts the new password without validating that the supplied reset code matches the one issued for the target account.

Because the code check is missing, an attacker who knows or guesses a target email address can call the endpoint directly and set an arbitrary password. Administrator email addresses are often predictable, such as admin@ or the address used during initial setup. Once the password is reset, the attacker authenticates normally and inherits full administrative privileges.

The vulnerability requires no prior authentication, no user interaction, and is reachable across the network wherever the Dify web interface is exposed.

Root Cause

The root cause is missing server-side verification of the password reset token in the reset handler. The endpoint trusts the client-supplied payload and updates the account credential without cross-checking the token against the stored, time-bound value issued during the forgot-password flow. This is a classic instance of [CWE-305], where the primary authentication factor for a sensitive state change is not enforced.

Attack Vector

The attack vector is network-based and unauthenticated. An attacker sends a crafted HTTP POST request to /forgot-password/resets containing the target account email and a chosen new password. The server applies the change without validating the reset code. The attacker then logs in using the new credentials. See the Huntr Vulnerability Bounty report for the disclosure record.

No verified proof-of-concept code has been published. The mechanism can be reproduced by issuing a direct request to the reset endpoint with any password value against a known account identifier.

Detection Methods for CVE-2024-12776

Indicators of Compromise

Unexpected HTTP POST requests to /forgot-password/resets that are not preceded by a matching /forgot-password initiation request from the same client.
Successful password changes for administrator accounts without a corresponding user-reported reset request or outbound reset email.
New administrator logins from unfamiliar IP addresses or geolocations shortly after a reset endpoint call.
Audit log entries showing password updates for multiple accounts within a short time window.

Detection Strategies

Inspect web server and reverse proxy logs for direct calls to /forgot-password/resets and correlate them with prior /forgot-password requests from the same session or IP.
Alert on password reset events for privileged accounts and require them to match a legitimate reset request in the application audit trail.
Deploy a web application firewall rule that blocks reset submissions lacking a valid, server-issued token bound to the requesting session.

Monitoring Recommendations

Forward Dify application, authentication, and reverse proxy logs to a centralized analytics platform for correlation across the reset workflow.
Track baseline volumes of password reset activity and alert on statistically significant spikes.
Monitor administrator account authentication events and enforce alerting on out-of-hours logins that follow a reset.

How to Mitigate CVE-2024-12776

Immediate Actions Required

Upgrade langgenius/dify to a version later than 0.10.1 that includes the fix for the reset endpoint. Consult the Huntr disclosure for the referenced remediation.
Restrict network exposure of the Dify management interface to trusted networks or a VPN until the patch is applied.
Force a password reset for all administrator and privileged accounts and rotate any API keys issued by the platform.
Review authentication and password change logs since deployment of version 0.10.1 for evidence of exploitation.

Patch Information

Upgrade to a Dify release later than 0.10.1 where the /forgot-password/resets handler verifies the reset token against the server-issued value before updating credentials. No vendor advisory URL is listed in the enriched data; track the Huntr Vulnerability Bounty entry and the project repository for the specific fixed version.

Workarounds

Block external access to /forgot-password/resets at a reverse proxy or WAF until the upgrade is completed.
Disable the self-service password reset flow in configuration and require administrator-driven password resets performed out-of-band.
Enforce multi-factor authentication on all administrator accounts so that a stolen password alone does not grant access.

bash

# Example reverse proxy rule to block the vulnerable endpoint (nginx)
location = /forgot-password/resets {
    return 403;
}