Unauthenticated Account Takeover in AnythingLLM via Weak Recovery Code Validation

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: GitHub, Inc.

Description

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. From 1.0.0 to 1.15.0, AnythingLLM's unauthenticated account-recovery flow in server/utils/PasswordRecovery/index.js uses recoverAccount() to deduplicate the raw recoveryCodes values before trimming them, so one valid code submitted twice with different surrounding whitespace can satisfy the two-code check. Each normalized value can also match the same stored hash instead of consuming a distinct hash. An attacker who knows the target username and one recovery code can call POST /api/system/recover-account in multi-user mode, receive a password-reset token, and use POST /api/system/reset-password to take over the account, including an administrator account.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-10

Last Modified

2026-08-10

Generated

2026-08-11

AI Q&A

2026-08-11

EPSS Evaluated

N/A

NVD

CVE-2026-72917

Affected Vendors & Products

Vendor	Product	Version / Range
anythingllm	anythingllm	From 1.0.0 (inc) to 1.15.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-180	The product validates input before it is canonicalized, which prevents the product from detecting data that becomes invalid after the canonicalization step.
CWE-287	When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

Executive Summary

AnythingLLM versions 1.0.0 to 1.15.0 have a flaw in the account recovery process. The system checks recovery codes by normalizing them but fails to properly validate distinct codes. An attacker can submit one valid recovery code twice with different whitespace, bypassing the two-code requirement. This allows them to reset the account password and gain full access, including admin accounts.

Impact Analysis

If you use AnythingLLM in multi-user mode, an attacker who knows your username and one recovery code could take over your account. This includes stealing sensitive data, impersonating you, or gaining admin privileges to control the entire system.

Mitigation Strategies

Update AnythingLLM to a version beyond 1.15.0 where the vulnerability is fixed. Disable unauthenticated account recovery if not needed. Monitor for suspicious POST /api/system/recover-account or POST /api/system/reset-password requests.

Hi! I’m here to help you understand CVE-2026-72917. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70