Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2024-5386: Lunary AI 1.2.2: Viewer Role Users Can Hijack Other Accounts

CVE-2024-5386 · published 9 months ago

Summary

A security issue in Lunary AI version 1.2.2 allows users with a 'viewer' role to steal password reset tokens and take control of other users' accounts. This can happen when a viewer role user makes a specific request to the server, which then sends the reset token. To protect your account, ensure that only authorized users have access to sensitive features and regularly review your account settings.

What to do

Update lunary lunary to version 1.2.14 or later.

Affected software

Vendor	Product	Affected versions
lunary	lunary	< 1.2.14 `cpe:2.3:a:lunary:lunary::::::::`

Original advisory text

In lunary-ai/lunary version 1.2.2, an account hijacking vulnerability exists due to a password reset token leak. A user with a 'viewer' role can exploit this vulnerability to hijack another user's account by obtaining the password reset token. The vulnerability is triggered when the 'viewer' role user sends a specific request to the server, which responds with a password reset token in the 'recoveryToken' parameter. This token can then be used to reset the password of another user's account without authorization. The issue results from an excessive attack surface, allowing lower-privileged users to escalate their privileges and take over accounts.

References

https://github.com/lunary-ai/lunary/commit/fc7ab3d5621c18992da5dab3a2a9a8d227d42... Broken Link
https://huntr.com/bounties/602eb4a1-305d-46d6-b975-5a5d8b040ad1 Exploit Patch Third Party Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

8.8 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-1125Excessive Attack Surface

Timeline

Published2 Feb 2026

Updated3 Nov 2026

First seen6 Mar 2026

Sources

CVE-2024-5386 · NVD

Track software like this

Free during beta