CVE-2025-1796

Summary

CVE-2025-1796 is a vulnerability affecting the langgenius/dify software version 0.10.1. This issue allows malicious actors to take over any account, including administrator accounts, by exploiting a weak pseudo-random number generator (PRNG) used for generating password reset codes. The application uses Python's `random.randint`, which is not designed for cryptographic use and can be susceptible to prediction. An attacker with access to workflow tools can extract the PRNG output and predict future password reset codes, resulting in a full compromise of the application.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.