CyberRota Analysis
AI-GeneratedThe AnythingLLM application versions 1.0.0 to 1.15.0 are vulnerable due to an insecure account-recovery process that allows an attacker to exploit whitespace discrepancies in recovery codes, potentially leading to unauthorized account access, including administrative accounts. This vulnerability poses a medium risk and should be prioritized by organizations using affected versions of AnythingLLM, particularly those with sensitive data or administrative functionalities. Immediate remediation is recommended to prevent potential account takeovers.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. From 1.0.0 to 1.15.0, AnythingLLM's unauthenticated account-recovery flow in server/utils/PasswordRecovery/index.js uses recoverAccount() to deduplicate the raw recoveryCodes values before trimming them, so one valid code submitted twice with different surrounding whitespace can satisfy the two-code check. Each normalized value can also match the same stored hash instead of consuming a distinct hash. An attacker who knows the target username and one recovery code can call POST /api/system/recover-account in multi-user mode, receive a password-reset token, and use POST /api/system/reset-password to take over the account, including an administrator account.