CVE-2026-72917

Name of the Vulnerable Software and Affected Versions AnythingLLM versions 1.0.0 through 1.15.0

Description The unauthenticated account-recovery flow in the server/utils/PasswordRecovery/index.js file uses the recoverAccount() function to deduplicate recoveryCodes values before they are trimmed. This allows a single valid recovery code submitted twice with different surrounding whitespace to bypass the requirement for two distinct codes. Additionally, each normalized value may match the same stored hash rather than consuming a unique hash. An attacker possessing a target username and one recovery code can use the 'POST /api/system/recover-account' endpoint in multi-user mode to obtain a password-reset token and subsequently use the 'POST /api/system/reset-password' endpoint to take over the account, including those with administrator privileges.

Recommendations Update AnythingLLM to a version later than 1.15.0.