EUVD-2026-55845Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Account takeover via forced password reset is high integrity impact (I:H); AC:H retained because a valid recovery code must be independently obtained as a prerequisite.
Primary rating from Vendor (github).
CVSS VectorVendor: github
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
2DescriptionCVE.org
AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. From 1.0.0 to 1.15.0, AnythingLLM's unauthenticated account-recovery flow in server/utils/PasswordRecovery/index.js uses recoverAccount() to deduplicate the raw recoveryCodes values before trimming them, so one valid code submitted twice with different surrounding whitespace can satisfy the two-code check. Each normalized value can also match the same stored hash instead of consuming a distinct hash. An attacker who knows the target username and one recovery code can call POST /api/system/recover-account in multi-user mode, receive a password-reset token, and use POST /api/system/reset-password to take over the account, including an administrator account.
AnalysisAI
Account takeover via recovery-code bypass in AnythingLLM 1.0.0-1.15.0 allows an unauthenticated remote attacker to seize full control of any user account, including administrator accounts, in multi-user mode. The flaw resides in server/utils/PasswordRecovery/index.js: raw recovery codes are deduplicated before whitespace trimming, so a single code submitted twice with differing surrounding whitespace satisfies the two-distinct-code requirement, and the hash-matching loop does not consume matched hashes, permitting one known code to match the same stored bcrypt hash twice. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | All three of the following conditions must hold simultaneously: (1) the AnythingLLM instance must be running in multi-user mode - the POST /api/system/recover-account endpoint is only active in this deployment configuration and does not exist in single-user mode; (2) the attacker must know the exact username of the target account; (3) the attacker must possess at least one valid recovery code previously issued to that account. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The official CVSS 3.1 score of 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) materially understates real-world impact: account takeover via forced password reset constitutes high integrity impact, yet I:N is scored - this appears to be a scoring error and is flagged explicitly. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has obtained an administrator's username and one valid recovery code - via a prior database exposure, phishing, or insider access - sends POST /api/system/recover-account with the single code submitted twice using trivially different whitespace padding (e.g., 'abc123' and ' abc123'). The pre-fix deduplication logic treats these as two distinct codes, the same bcrypt hash matches both slots, and the endpoint returns a valid password-reset token. … |
| Remediation | The upstream fix is confirmed in GitHub commit 61766d06b77b903f66dc4afd8dffb3a39012db14 (https://github.com/Mintplex-Labs/anything-llm/commit/61766d06b77b903f66dc4afd8dffb3a39012db14); a specific patched release version number is not confirmed in the provided data, so administrators should monitor the advisory at GHSA-vv8w-wg6r-hq56 and upgrade to the first release beyond 1.15.0 that incorporates this commit. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today