What is CVE-2025-1796?

CVE-2025-1796 is a high-severity vulnerability in Langgenius Dify, classified under Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG). CVSS score: 8.8/10. Published 2025-03-20.

How severe is CVE-2025-1796?

High severity. CVSS v3 base score is 8.8 out of 10.

Is CVE-2025-1796 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Langgenius Dify

CVE-2025-1796

A vulnerability in langgenius/dify v0.10.1 allows an attacker to take over any account, including administrator accounts, by exploiting a weak pseudo-random number generator (PRNG) used for generating password reset codes. The application uses `random.randint` for this purpose, which is not suitable for cryptographic use and can be cracked. An attacker with access to workflow tools can extract the PRNG output and predict future password reset codes, leading to a complete compromise of the application.

EPSS: 0.006 (45.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Langgenius Dify — versions 0.10.1
Langgenius Langgenius/dify — versions unspecified

Weakness classification (CWE)

CWE-338 — Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

Public proof-of-concept exploits

ARPSyndicate/cve-scores

References

security@huntr.dev (Exploit, Third Party Advisory)

Frequently asked questions

What is CVE-2025-1796?: CVE-2025-1796 is a high-severity vulnerability in Langgenius Dify, classified under Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG). CVSS score: 8.8/10. Published 2025-03-20.
How severe is CVE-2025-1796?: High severity. CVSS v3 base score is 8.8 out of 10.
Is CVE-2025-1796 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.