CVE-2026-72917
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
In AnythingLLM versions 1.0.0 to 1.15.0, the unauthenticated account-recovery flow has a flaw in recoverAccount() that fails to trim recovery code values before deduplication. An attacker knowing the username and one recovery code can submit the same code twice with different whitespace to satisfy the two-code check and take over an account, including an administrator.
Risk Assessment
Risk of administrator account takeover and full control over the application, potentially leading to data confidentiality and integrity breaches.
Recommendation
Upgrade AnythingLLM to a version newer than 1.15.0 where this issue is fixed. If not possible, restrict access to the account recovery functionality.
Original NVD description (English source)
AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. From 1.0.0 to 1.15.0, AnythingLLM's unauthenticated account-recovery flow in server/utils/PasswordRecovery/index.js uses recoverAccount() to deduplicate the raw recoveryCodes values before trimming them, so one valid code submitted twice with different surrounding whitespace can satisfy the two-code check. Each normalized value can also match the same stored hash instead of consuming a distinct hash. An attacker who knows the target username and one recovery code can call POST /api/system/recover-account in multi-user mode, receive a password-reset token, and use POST /api/system/reset-password to take over the account, including an administrator account.