CVE-2026-72917: One Recovery Code Used Twice to Bypass AnythingLLM Account Recovery
AnythingLLM 1.0.0 through 1.15.0 lets a single recovery code satisfy the two-code check when submitted twice with different whitespace, enabling account takeover including admin accounts.
Contents
TL;DR: AnythingLLM versions 1.0.0 through 1.15.0 accept a single recovery code submitted twice with different surrounding whitespace, satisfying the two-code check meant to protect account recovery. An attacker who knows a target username and possesses one recovery code can obtain a password-reset token and take over the account, including administrator accounts. Fixed in the latest release.
How the attack works
AnythingLLM's multi-user mode requires two recovery codes to reset a password. The check lives in server/utils/PasswordRecovery/index.js, inside the recoverAccount() function. The function receives an array of recovery codes from the POST /api/system/recover-account endpoint and validates each against a stored hash.
The bug is in the order of operations. recoverAccount() deduplicates the raw recoveryCodes array before trimming whitespace from each entry. Two submissions of the same code with different padding, such as "ABC123" and ABC123 , survive the deduplication step because the raw strings differ. After trimming, both normalize to the same value and both match the same stored hash. The two-code requirement is satisfied by one code.
The attacker does not need special privileges. The /api/system/recover-account endpoint is unauthenticated. The only prerequisites are knowing the target's username and holding a single valid recovery code. Recovery codes in AnythingLLM are generated alongside user creation and may be exposed through prior information disclosure, social engineering, or predictable generation. Once recoverAccount() returns a password-reset token, the attacker calls POST /api/system/reset-password to set a new password and take full control of the account.
Who is affected
AnythingLLM is an open-source application from Mintplex-Labs that converts documents, web pages, and other content into vector embeddings that language models can reference during chat. It has over 40,000 GitHub stars and is one of the most popular self-hosted AI knowledge base platforms. Organizations use it to build private document chatbots, internal Q&A systems, and RAG-powered assistants.
Any AnythingLLM deployment running multi-user mode with versions 1.0.0 through 1.15.0 is vulnerable. Single-user mode is not affected because account recovery does not apply. Administrators who configured multi-user mode and generated recovery codes during user creation are the highest-value targets. An attacker who compromises an admin account gains access to all workspaces, API keys, and embedded content.
What to do
Update AnythingLLM to the latest release. The fix trims each recovery code before deduplication, so whitespace variants of the same code collapse into a single entry and the two-code requirement enforces two genuinely distinct codes.
If you cannot update immediately, disable multi-user mode or restrict network access to the AnythingLLM instance. Audit admin accounts for unauthorized password changes. Regenerate recovery codes for all users after patching.
Why it matters
Account takeover via recovery flow abuse is a direct path to privilege escalation. In a platform like AnythingLLM that handles sensitive documents and API integrations, admin access means full data exfiltration. The unauthenticated nature of the endpoint removes the last barrier for external attackers. NVD enrichment is pending at time of writing.
References
Continue reading
All posts
CVE-2026-72603: wg-easy WireGuard UI Lets Low-Privilege Users Execute Root Commands
wg-easy 15.3.0 has an OS command injection vulnerability in its client creation flow. Users with clients.create permission can inject WireGuard PostUp directives via newlines in the client name field, achieving root code execution.
CVE-2026-72533: Portainer CE Authentication Bypass Grants Root Access to Docker Hosts
Portainer CE through 2.44.0 has an authentication bypass in its Docker proxy endpoint. Low-privileged users can craft non-canonical URL paths to bypass authorization checks and gain root-level access to the Docker host.
CVE-2026-58231: Unauthenticated RCE in SAP Commerce Cloud Data Hub Adapter
SAP Commerce Cloud Data Hub Adapter ships with a default authentication client. An unauthenticated attacker can submit crafted input to validation-lacking functions, achieving arbitrary code execution. No fix available yet.