CVE-2026-21484: AnythingLLM Information Disclosure Flaw

CVE-2026-21484 Overview

AnythingLLM is an application that transforms content into contextual references for Large Language Models (LLMs) during chat interactions. A username enumeration vulnerability exists in the password recovery endpoint, where different error messages are returned depending on whether a username exists in the system. This information disclosure flaw allows attackers to enumerate valid usernames, which can be leveraged for subsequent targeted attacks such as credential stuffing, phishing, or brute-force password attacks.

Critical Impact

Attackers can enumerate valid usernames through the password recovery endpoint, enabling targeted authentication attacks against confirmed user accounts.

Affected Products

• AnythingLLM (versions prior to commit e287fab56089cf8fcea9ba579a3ecdeca0daa313)

Discovery Timeline

• 2026-01-03 - CVE CVE-2026-21484 published to NVD
• 2026-01-08 - Last updated in NVD database

Technical Details for CVE-2026-21484

Vulnerability Analysis

This vulnerability is classified under CWE-203 (Observable Discrepancy), which occurs when application responses differ based on internal state or data, allowing attackers to infer protected information. In this case, the password recovery functionality in AnythingLLM returns distinct error messages when a recovery attempt is made for existing versus non-existing usernames.

The vulnerability is exploitable over the network without authentication, making it accessible to any remote attacker. While the direct impact is limited to information disclosure (username enumeration), this information can significantly amplify the effectiveness of follow-up attacks such as credential stuffing campaigns using known username lists or targeted phishing attacks against confirmed users.

Root Cause

The root cause lies in the password recovery implementation within server/utils/PasswordRecovery/index.js. The recovery code validation logic returns different error messages based on internal conditions, specifically when checking if a user has sufficient recovery code hashes. The differentiated error responses allow attackers to distinguish between valid and invalid usernames by observing the specific error message returned.

Attack Vector

An attacker can exploit this vulnerability by sending password recovery requests with various usernames and analyzing the error responses. By comparing the error messages returned for known-invalid usernames against test usernames, the attacker can build a list of valid user accounts. This attack requires no authentication and can be automated to rapidly enumerate large numbers of potential usernames.

The attack methodology involves:

1. Sending password recovery requests to the vulnerable endpoint
2. Observing the specific error message returned
3. Comparing responses to identify patterns that indicate valid usernames
4. Building a list of confirmed valid accounts for further exploitation

Detection Methods for CVE-2026-21484

Indicators of Compromise

• Unusual volume of password recovery requests from a single IP address or IP range
• Sequential or patterned username attempts in password recovery logs
• Multiple failed recovery attempts across different usernames within a short timeframe
• Automated traffic patterns targeting the password recovery endpoint

Detection Strategies

• Monitor HTTP request logs for high-frequency access to the password recovery endpoint
• Implement rate limiting alerts that trigger on excessive recovery attempts
• Deploy web application firewall (WAF) rules to detect enumeration patterns
• Analyze authentication logs for correlation between recovery attempts and subsequent login failures

Monitoring Recommendations

• Set up alerting for abnormal spikes in password recovery API calls
• Track unique usernames attempted per source IP within sliding time windows
• Monitor for automated tool signatures in User-Agent strings and request patterns
• Correlate recovery attempts with subsequent brute-force or credential stuffing activity

How to Mitigate CVE-2026-21484

Immediate Actions Required

• Update AnythingLLM to a version containing commit e287fab56089cf8fcea9ba579a3ecdeca0daa313 or later
• Implement rate limiting on the password recovery endpoint to slow enumeration attempts
• Review authentication logs for signs of past enumeration attempts
• Consider implementing CAPTCHA on the password recovery form

Patch Information

The vulnerability has been addressed in commit e287fab56089cf8fcea9ba579a3ecdeca0daa313. The fix normalizes the error response by ensuring consistent messaging regardless of whether the username exists. Additional details are available in the GitHub Security Advisory GHSA-47vr-w3vm-69ch.

The patch modifies the error message handling to eliminate observable differences:

   // because this is a user who has not logged out and back in since upgrade.
   const allUserHashes = await RecoveryCode.hashesForUser(user.id);
   if (allUserHashes.length < 4)
-    return { success: false, error: "Invalid recovery codes" };
+    return { success: false, error: "Invalid recovery codes." };
 
   // If they tried to send more than two unique codes, we only take the first two
   const uniqueRecoveryCodes = [...new Set(recoveryCodes)]

Source: GitHub Commit e287fab

Workarounds

• Implement a reverse proxy or WAF rule to return generic responses for all password recovery requests
• Deploy rate limiting at the network or application layer to restrict recovery attempts per IP
• Add CAPTCHA or similar challenge-response mechanisms to the recovery flow
• Consider temporarily disabling the password recovery feature until the patch can be applied