CVE-2026-21484

Name of the Vulnerable Software and Affected Versions AnythingLLM (affected versions not specified)

Description AnythingLLM is an application designed to provide context for Large Language Models (LLMs). Prior to commit e287fab56089cf8fcea9ba579a3ecdeca0daa313, the password recovery functionality exposed different error messages based on the existence of a username, allowing for username enumeration. The /password-recovery API endpoint was vulnerable to this issue. This allowed an attacker to determine valid usernames by observing the response to requests with different username values.

Recommendations Update to a version after commit e287fab56089cf8fcea9ba579a3ecdeca0daa313.