Executive brief
Lumiverse is an AI chat application. A security flaw in the user registration process allows unauthorized individuals to create accounts on the system without permission. This occurs when an administrator's attempt to create a user fails, leaving a brief 10-second window where any person can register an account. If combined with other vulnerabilities, this could lead to unauthorized access or control over the server.
Technical details
A race condition exists in the `consumeNonce()` function within `Lumiverse/src/auth/index.ts`. The application uses a module-level variable to store a registration nonce that is valid for 10 seconds after an administrator initiates a user creation. However, the system only checks if the nonce exists and is unexpired; it does not validate the nonce value against the incoming request or bind it to the administrator's session. If an admin's registration call fails (e.g., due to a duplicate email validation error), the nonce remains active and unconsumed. An attacker who can predict or observe this window can submit a POST request to `/api/auth/sign-up/email` to successfully register an account. This issue is fixed in version 0.9.7 by binding nonces to specific requests.
Affected products
- prolix-oc Lumiverse < 0.9.7
- npm lumiverse-backend <= 0.9.5
Timeline
- 2026-05-06: advisory: GitHub advisory published by maintainer
- 2026-05-26: disclosed: CVE published to NVD
- 2026-05-26: patched: Vulnerability fixed in version 0.9.7