Executive Summary

This vulnerability exists in Lumiverse AI chat application versions prior to 0.9.7. The function consumeNonce() only checks if a module-level nonce variable is set and unexpired but does not validate the nonce against the incoming HTTP request or bind it to the admin's session.

If an admin's sign-up email call fails before a certain hook fires (for example, if BetterAuth rejects a duplicate email), the nonce remains set but is never consumed. During this remaining window (about 10 seconds), any POST request to /api/auth/sign-up/email can register successfully regardless of who sent it.

An attacker who can observe or predict when the admin is creating users, especially duplicate users, can exploit this timing window to register unauthorized accounts.

This issue was fixed in version 0.9.7.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker to register unauthorized user accounts by exploiting a timing window during the admin's user creation process.

Such unauthorized accounts could potentially be used to gain improper access, escalate privileges, or perform malicious actions within the Lumiverse application.

Because the attacker does not need to be authenticated and only needs to predict or observe the admin's actions, this can lead to unauthorized access and compromise of the system's integrity.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability is fixed in Lumiverse version 0.9.7. Immediate mitigation involves upgrading Lumiverse to version 0.9.7 or later.

Until the upgrade is applied, be aware that any POST /api/auth/sign-up/email requests during a 10-second window after a failed signUpEmail() call may allow unauthorized account registration.

Useful 0 Not Useful 0