Quick answers
- Is CVE-2026-44443 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-44443 being exploited in the wild.
- How severe is CVE-2026-44443?
- Medium severity, with a CVSS score of 4.8, published 26 May 2026.
- Which products and versions are affected?
- Lumiverse-Backend <= 0.9.5; Prolix-Oc Lumiverse < 0.9.7.
- Is there a fix for CVE-2026-44443?
- A patch was published on 2026-05-26: Vulnerability fixed in version 0.9.7 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-44443 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-44443?
- Check whether you run Lumiverse-Backend or Prolix-Oc Lumiverse at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A race condition exists in the `consumeNonce()` function within `Lumiverse/src/auth/index.ts`. The application uses a module-level variable to store a registration nonce that is valid for 10 seconds after an administrator initiates a user creation. However, the system only checks if the nonce exists and is unexpired; it does not validate the nonce value against the incoming request or bind it to the administrator's session. If an admin's registration call fails (e.g., due to a duplicate email validation error), the nonce remains active and unconsumed. An attacker who can predict or observe this window can submit a POST request to `/api/auth/sign-up/email` to successfully register an account. This issue is fixed in version 0.9.7 by binding nonces to specific requests.
Affected products
- prolix-oc Lumiverse < 0.9.7
- npm lumiverse-backend <= 0.9.5
Timeline
- 2026-05-06: advisory: GitHub advisory published by maintainer
- 2026-05-26: disclosed: CVE published to NVD
- 2026-05-26: patched: Vulnerability fixed in version 0.9.7