CVE-2026-44443

Lumiverse is a full-featured AI chat application. Prior to 0.9.7, consumeNonce() only checks that the module-level variable is set and unexpired. It does not validate any value from the incoming HTTP request or bind the nonce to the admin's session. If the admin's auth.api.signUpEmail() call fails before the before hook fires (e.g. BetterAuth rejects a duplicate email at the validation layer), the nonce is set but never consumed. Any POST /api/auth/sign-up/email request that arrives during the remaining window registers successfully regardless of who sent it. An attacker who can observe or predict when the admin is creating users (must be a dupplicate user) can race the 10-second window to register an unauthorized account. This vulnerability is fixed in 0.9.7.

• CWE-362

• https://github.com/prolix-oc/Lumiverse/security/advisories/GHSA-6fcp-x253-wwv7
• https://github.com/prolix-oc/Lumiverse/security/advisories/GHSA-6fcp-x253-wwv7

Published

May 26, 2026

Last Modified

Jul 20, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-44437The Angular SSR is a server-rise rendering tool for Angular …6.1
• CVE-2026-44439PlaywrightCapture is a simple replacement for splash using p…7.5
• CVE-2026-4444Stack buffer overflow in WebRTC in Google Chrome prior to 14…8.8
• CVE-2026-44440ERPNext is a free and open source Enterprise Resource Planni…5.7
• CVE-2026-44441ERPNext is a free and open source Enterprise Resource Planni…4.3
• CVE-2026-44442ERPNext is a free and open source Enterprise Resource Planni…9.9
• CVE-2026-44444Lumiverse is a full-featured AI chat application. Prior to 0…9.1
• CVE-2026-44445ERPNext is a free and open source Enterprise Resource Planni…6.5
• CVE-2026-44446ERPNext is a free and open source Enterprise Resource Planni…7.5
• CVE-2026-44447ERPNext is a free and open source Enterprise Resource Planni…7.5
• CVE-2026-44448ERPNext is a free and open source Enterprise Resource Planni…6.5
• CVE-2026-44449Lumiverse is a full-featured AI chat application. Prior to 0…9.1