Vulnerability Description
AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. From 1.0.0 to 1.15.0, AnythingLLM's unauthenticated account-recovery flow in server/utils/PasswordRecovery/index.js uses recoverAccount() to deduplicate the raw recoveryCodes values before trimming them, so one valid code submitted twice with different surrounding whitespace can satisfy the two-code check. Each normalized value can also match the same stored hash instead of consuming a distinct hash. An attacker who knows the target username and one recovery code can call POST /api/system/recover-account in multi-user mode, receive a password-reset token, and use POST /api/system/reset-password to take over the account, including an administrator account.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/Mintplex-Labs/anything-llm/commit/61766d06b77b903f66dc4afd8df
- https://github.com/Mintplex-Labs/anything-llm/security/advisories/GHSA-vv8w-wg6r
FAQ
What is CVE-2026-72917?
CVE-2026-72917 is a vulnerability with a CVSS score of 5.9 (MEDIUM). AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. From 1.0.0 to 1.15.0, AnythingLLM's unauthenticated account-recovery flow in...
How severe is CVE-2026-72917?
CVE-2026-72917 has been rated MEDIUM with a CVSS base score of 5.9/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-72917?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.