Executive brief
Lunary is an AI application monitoring and logging platform. A flaw in its user invitation system allows attackers to hijack authentication tokens meant for new users, enabling password resets and complete account takeover of arbitrary user accounts. The vulnerability has been withdrawn from the advisory database because it affects an unsupported package variant, though the underlying security issue remains valid.
Technical details
The vulnerability is an improper access control issue (CWE-284) in Lunary's user invitation flow. An attacker can intercept one-time-use auth tokens issued during the 'invite user' workflow, retract the invitation, and later reuse those tokens to reset passwords and obtain valid JWT tokens for arbitrary user accounts. The attack requires network access and does not require prior authentication, but does require knowledge of target email addresses. The advisory was withdrawn because the npm package "lunary" is disconnected from the vulnerable repository (lunary-ai/lunary); however, the underlying flaw in the auth token handling is documented as fixed in commit 844e8855c7a713dc7371766dba4125de4007b1cf.
Affected products
- Lunary AI Lunary prior to 1.4.9
Timeline
- 2024-09-13: disclosed
- 2024-09-13: patched: Fix available in commit 844e8855c7a713dc7371766dba4125de4007b1cf; version 1.4.9 or later
- 2025-06-20: other: Advisory withdrawn from GitHub Advisory Database due to package ecosystem mismatch