CVE Feed

    Dashboard / CVE / CVE-2024-1739

    CVE-2024-1739

    lunary-ai/lunary is vulnerable to an authentication issue due to improper validation of email addresses during the signup process. Specifically, the server fails to treat email addresses as case insensitive, allowing the creation of multiple accounts with the same email address by varying the case of the email characters. For example, accounts for '[email protected]' and '[email protected]' can both be created, leading to potential impersonation and confusion among users.

    Published:Apr 15, 2024
    Last Modified:Jun 18, 2025
    EPS:Apr 16, 2024
    EPSS Score:0.00179
    CVSS Score:9.1

    Affected Products

    Vendor
    Lunary
    Product
    Lunary

    Exploits

    https://huntr.com/bounties/2ca70ba5-b6a4-4873-bd55-bc6cef40d300https://huntr.com/bounties/2ca70ba5-b6a4-4873-bd55-bc6cef40d300

    Common Weakness Enumeration

    CWE-821 Incorrect Synchronization

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2024-5386 (CVSS 8.8) — In lunary-ai/lunary version 1.2.2, an account hijacking vulnerability exists due to a password reset token lea…
    CVE-2024-4147 (CVSS 6.5) — In lunary-ai/lunary version 1.2.13, an insufficient granularity of access control vulnerability allows users t…
    CVE-2025-9803 (CVSS 8.8) — lunary-ai/lunary version 1.9.34 is vulnerable to an account takeover due to improper authentication in the Goo…
    CVE-2025-5352 (CVSS 9.6) — A critical stored Cross-Site Scripting (XSS) vulnerability exists in the Analytics component of lunary-ai/luna…
    CVE-2025-4779 (CVSS 6.1) — lunary-ai/lunary versions prior to 1.9.24 are vulnerable to stored cross-site scripting (XSS). An unauthentica…
    CVE-2024-11300 (CVSS 6.5) — In lunary-ai/lunary before version 1.6.3, an improper access control vulnerability exists where a user can acc…
    CVE-2024-10272 (CVSS 7.5) — lunary-ai/lunary is vulnerable to broken access control in the latest version. An attacker can view the conten…
    CVE-2024-8998 (CVSS 7.5) — A Regular Expression Denial of Service (ReDoS) vulnerability exists in lunary-ai/lunary version git f07a845. T…
    CVE-2025-0281 (CVSS 5.4) — A stored cross-site scripting (XSS) vulnerability exists in lunary-ai/lunary versions 1.6.7 and earlier. An at…
    CVE-2024-9099 (CVSS 8.1) — In lunary-ai/lunary version v1.4.29, the GET /projects API endpoint exposes both public and private API keys f…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High