{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:lunary:lunary:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "4EBE68D2-D623-498C-B3E2-44FD5E213CA2",
              "versionEndExcluding": "1.2.14",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In lunary-ai/lunary version 1.2.2, an account hijacking vulnerability exists due to a password reset token leak. A user with a \u0027viewer\u0027 role can exploit this vulnerability to hijack another user\u0027s account by obtaining the password reset token. The vulnerability is triggered when the \u0027viewer\u0027 role user sends a specific request to the server, which responds with a password reset token in the \u0027recoveryToken\u0027 parameter. This token can then be used to reset the password of another user\u0027s account without authorization. The issue results from an excessive attack surface, allowing lower-privileged users to escalate their privileges and take over accounts."
    },
    {
      "lang": "es",
      "value": "En lunary-ai/lunary versi\u00f3n 1.2.2, existe una vulnerabilidad de secuestro de cuentas debido a una fuga de token de restablecimiento de contrase\u00f1a. Un usuario con rol de \u0027viewer\u0027 puede explotar esta vulnerabilidad para secuestrar la cuenta de otro usuario al obtener el token de restablecimiento de contrase\u00f1a. La vulnerabilidad se activa cuando el usuario con rol de \u0027viewer\u0027 env\u00eda una solicitud espec\u00edfica al servidor, que responde con un token de restablecimiento de contrase\u00f1a en el par\u00e1metro \u0027recoveryToken\u0027. Este token puede entonces ser utilizado para restablecer la contrase\u00f1a de la cuenta de otro usuario sin autorizaci\u00f3n. El problema se debe a una superficie de ataque excesiva, permitiendo a usuarios con privilegios inferiores escalar sus privilegios y tomar el control de cuentas."
    }
  ],
  "id": "CVE-2024-5386",
  "lastModified": "2026-02-11T21:03:48.213",
  "metrics": {
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 9.6,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
          "version": "3.0"
        },
        "exploitabilityScore": 3.1,
        "impactScore": 5.8,
        "source": "security@huntr.dev",
        "type": "Secondary"
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2026-02-02T11:16:16.590",
  "references": [
    {
      "source": "security@huntr.dev",
      "tags": [
        "Broken Link"
      ],
      "url": "https://github.com/lunary-ai/lunary/commit/fc7ab3d5621c18992da5dab3a2a9a8d227d42311"
    },
    {
      "source": "security@huntr.dev",
      "tags": [
        "Exploit",
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://huntr.com/bounties/602eb4a1-305d-46d6-b975-5a5d8b040ad1"
    }
  ],
  "sourceIdentifier": "security@huntr.dev",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-1125"
        }
      ],
      "source": "security@huntr.dev",
      "type": "Primary"
    }
  ]
}