Race Condition Vulnerability in mintplex-labs/anything-llm

A race condition vulnerability exists in the mintplex-labs/anything-llm repository, specifically within the user invite acceptance process. Attackers can exploit this vulnerability by sending multiple concurrent requests to accept a single user invite, allowing the creation of multiple user accounts from a single invite link intended for only one user. This bypasses the intended security mechanism that restricts invite acceptance to a single user, leading to unauthorized user creation without detection in the invite tab. The issue is due to the lack of validation for concurrent requests in the backend.

N/A

检查时间与使用时间(TOCTOU)的竞争条件

AnythingLLM 安全漏洞

AnythingLLM是符合业务要求的文档聊天机器人。 AnythingLLM存在安全漏洞，该漏洞源于攻击者可以通过发送多个并发请求来接受单个用户邀请，从而允许从仅针对一个用户的单个邀请链接创建多个用户帐户。

N/A

N/A