AnythingLLM - Information Disclosure (CVE-2026-21484)
Description
AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. Prior to commit e287fab56089cf8fcea9ba579a3ecdeca0daa313, the password recovery endpoint returns different error messages depending on whether a username exists, so enabling username enumeration. Commit e287fab56089cf8fcea9ba579a3ecdeca0daa313 fixes this issue.
psychologyCrowdSec Analysis
CVE-2026-21484 is an information disclosure vulnerability in AnythingLLM that allows attackers to enumerate valid usernames via the password recovery endpoint, due to differing error messages. This flaw could be exploited to aid in targeted attacks such as credential stuffing or brute-force attempts by confirming the existence of user accounts.
CrowdSec has been tracking this vulnerability and its exploits since 6th of May 2026.
CrowdSec network observations suggest that most exploitation of CVE-2026-21484 involves focused reconnaissance to identify viable targets. Attackers typically tailor their campaigns based on system exposure and configuration. It is unlikely that a given attack is accidental. Data from the CrowdSec community also indicates a gradual decrease in attacks targeting CVE-2026-21484. While still present in the wild, exploitation levels have dropped noticeably week-over-week. This may signal that the vulnerability is becoming less relevant or that defenses are improving fast enough for attackers to lose interest.
Attackers target the /api/system/recover-account endpoint by submitting password recovery requests with different usernames, allowing them to enumerate valid usernames based on variations in the error messages returned.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2026-01-03 |
| Rule Released | 2026-05-06 |
| CrowdSec First Seen | 2026-05-18 |
Related Weaknesses
The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor.
The product provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intended control sphere.