# CVE-2026-44443: Lumiverse race condition in user registration nonce

Source: https://junglewise.ai/threats/cve-2026-44443-lumiverse-race-condition-in-user-registration-nonce  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-26. Updated: 2026-05-26  
License: CC BY 4.0 with a link back

CVE-2026-44443 · Severity: medium · CVSS 4.8 · Published 2026-05-26

Lumiverse is an AI chat application. A security flaw in the user registration process allows unauthorized individuals to create accounts on the system without permission. This occurs when an administrator's attempt to create a user fails, leaving a brief 10-second window where any person can register an account. If combined with other vulnerabilities, this could lead to unauthorized access or control over the server.

Technologies: [Prolix-Oc Lumiverse](https://junglewise.ai/threats/technologies/lumiverse). Vendors: [Prolix-Oc](https://junglewise.ai/threats/vendors/prolix-oc).

## Quick answers

**Is CVE-2026-44443 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44443 being exploited in the wild.

**How severe is CVE-2026-44443?** Medium severity, with a CVSS score of 4.8, published 26 May 2026.

**Which products and versions are affected?** Lumiverse-Backend <= 0.9.5; Prolix-Oc Lumiverse < 0.9.7.

**Is there a fix for CVE-2026-44443?** A patch was published on 2026-05-26: Vulnerability fixed in version 0.9.7 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-44443 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-44443?** Check whether you run Lumiverse-Backend or Prolix-Oc Lumiverse at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A race condition exists in the `consumeNonce()` function within `Lumiverse/src/auth/index.ts`. The application uses a module-level variable to store a registration nonce that is valid for 10 seconds after an administrator initiates a user creation. However, the system only checks if the nonce exists and is unexpired; it does not validate the nonce value against the incoming request or bind it to the administrator's session. If an admin's registration call fails (e.g., due to a duplicate email validation error), the nonce remains active and unconsumed. An attacker who can predict or observe this window can submit a POST request to `/api/auth/sign-up/email` to successfully register an account. This issue is fixed in version 0.9.7 by binding nonces to specific requests.

## Affected products

- prolix-oc Lumiverse < 0.9.7
- npm lumiverse-backend <= 0.9.5

## Timeline

- 2026-05-06: advisory: GitHub advisory published by maintainer
- 2026-05-26: disclosed: CVE published to NVD
- 2026-05-26: patched: Vulnerability fixed in version 0.9.7

## References

- [https://github.com/prolix-oc/Lumiverse/security/advisories/GHSA-6fcp-x253-wwv7](https://github.com/prolix-oc/Lumiverse/security/advisories/GHSA-6fcp-x253-wwv7)

## Related threats

- [prolix-oc Lumiverse sandbox escape in TSX component overrides](https://junglewise.ai/threats/cve-2026-44451-prolix-oc-lumiverse-sandbox-escape-in-tsx-component-overrides)
- [Lumiverse argument injection in MCP server creation endpoint](https://junglewise.ai/threats/cve-2026-44450-lumiverse-argument-injection-in-mcp-server-creation-endpoint)
- [Lumiverse command injection in SMBFileSystem via smbclient escape](https://junglewise.ai/threats/cve-2026-44449-lumiverse-command-injection-in-smbfilesystem-via-smbclient-escape)
- [Lumiverse RCE via untrusted lifecycle scripts in Spindle extensions](https://junglewise.ai/threats/cve-2026-44444-lumiverse-rce-via-untrusted-lifecycle-scripts-in-spindle)