lunary-ai/lunary is vulnerable to an authentication issue due to improper validation of email addresses during the signup process. Specifically, the server fails to treat email addresses as case insensitive, allowing the creation of multiple accounts with the same email address by varying the case of the email characters. For example, accounts for 'abc@gmail.com' and 'Abc@gmail.com' can both be created, leading to potential impersonation and confusion among users.
The server does not normalize email addresses to uniform letter case before checking their uniqueness during the registration process. An attacker can register an account with an email address differing in letter case from an already existing account (e.g., 'Abc@gmail.com' instead of 'abc@gmail.com'). As a result, two separate accounts are created in the system linked to the same email address, leading to confusion and the possibility of impersonating another user.
An attacker can impersonate an existing user by creating an account with an identical email address differing only in letter case, which may result in unauthorized access to resources or misleading other system participants. Both data confidentiality and integrity are at risk.
The application should be updated to a version containing the fix introduced by commit 7351157a21e5acd0162b4528bcae9d65b1c95695 in the lunary-ai/lunary GitHub repository. The patch enforces case-insensitive email address handling during registration.
Product lunary-ai/lunary — versions indicated in the vendor references (before commit 7351157a21e5acd0162b4528bcae9d65b1c95695)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NLunary
APPLunary< 1.0.2
Related vulnerabilities
Stored XSS w Lunary — wstrzyknięcie skryptu przez zmienną środowiskową
Brak kontroli dostępu w API BigQuery — eksport całej bazy danych w Lunary
SQL Injection w trasie /api/v1/external-users aplikacji Lunary
Lunary: brak kontroli dostępu do konfiguracji SAML (nieautoryzowana zmiana)
Błąd autoryzacji w Lunary umożliwiający pełny dostęp do projektów