CVE-2026-44443
Authentication Bypass in Lumiverse AI Chat
Publication date: 2026-05-26
Last updated on: 2026-05-26
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| lumiverse | ai_chat_application | 0.9.7 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-362 | The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in Lumiverse AI chat application versions prior to 0.9.7. The function consumeNonce() only checks if a module-level nonce variable is set and unexpired but does not validate the nonce against the incoming HTTP request or bind it to the admin's session.
If an admin's sign-up email call fails before a certain hook fires (for example, if BetterAuth rejects a duplicate email), the nonce remains set but is never consumed. During this remaining window (about 10 seconds), any POST request to /api/auth/sign-up/email can register successfully regardless of who sent it.
An attacker who can observe or predict when the admin is creating users, especially duplicate users, can exploit this timing window to register unauthorized accounts.
This issue was fixed in version 0.9.7.
How can this vulnerability impact me? :
This vulnerability allows an attacker to register unauthorized user accounts by exploiting a timing window during the admin's user creation process.
Such unauthorized accounts could potentially be used to gain improper access, escalate privileges, or perform malicious actions within the Lumiverse application.
Because the attacker does not need to be authenticated and only needs to predict or observe the admin's actions, this can lead to unauthorized access and compromise of the system's integrity.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability is fixed in Lumiverse version 0.9.7. Immediate mitigation involves upgrading Lumiverse to version 0.9.7 or later.
Until the upgrade is applied, be aware that any POST /api/auth/sign-up/email requests during a 10-second window after a failed signUpEmail() call may allow unauthorized account registration.