CVE-2025-1796: Admin account takeover through weak Pseudo-Random number generator used in generating password reset codes in langgenius/dify
First published: Thu Mar 20 2025(Updated: )
A vulnerability in langgenius/dify v0.10.1 allows an attacker to take over any account, including administrator accounts, by exploiting a weak pseudo-random number generator (PRNG) used for generating password reset codes. The application uses `random.randint` for this purpose, which is not suitable for cryptographic use and can be cracked. An attacker with access to workflow tools can extract the PRNG output and predict future password reset codes, leading to a complete compromise of the application.
Credit: security@huntr.dev
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Dify |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the severity of CVE-2025-1796?
CVE-2025-1796 is classified as a critical vulnerability due to its potential for account takeover.
How do I fix CVE-2025-1796?
To fix CVE-2025-1796, update langgenius/dify to the latest version where the weak PRNG issue is addressed.
Who is affected by CVE-2025-1796?
Any user of langgenius/dify version 0.10.1 is affected by CVE-2025-1796, including administrators.
What are the implications of exploiting CVE-2025-1796?
Exploiting CVE-2025-1796 allows an attacker to take over user accounts, potentially leading to unauthorized access to sensitive information.
How does CVE-2025-1796 work?
CVE-2025-1796 works by exploiting a weak pseudo-random number generator used to create password reset codes, making them predictable.
- agent/references
- agent/title
- agent/weakness
- agent/description
- agent/type
- agent/first-publish-date
- collector/nvd-api
- source/NVD
- agent/author
- agent/severity
- agent/source
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/tags
- agent/softwarecombine
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/langgenius
- canonical/dify