CVE-2026-44443 Details

A race condition vulnerability has been identified in Lumiverse, an AI chat application, prior to version 0.9.7. The issue arises in the user registration process, where the nonce used to validate sign-up requests is not properly bound to the admin's session or validated against incoming HTTP request values. Instead, the nonce is set at the module level and remains valid for 10 seconds. If an admin attempts to register a user with a duplicate email, the nonce is activated but not consumed, leaving a window during which unauthorized sign-ups can occur. An attacker aware of this timing can exploit the vulnerability to create accounts without authorization.

To address this vulnerability, bind the nonce to the specific sign-up request instead of the module state. Modify the nonce consumption function to accept an expected value and verify it against the admin's current sign-up request, ensuring that only the intended request can use the nonce.