What’s Vulnerable › Vulnerabilities

CVE-2024-1739: Case Insensitive Email Address Validation Vulnerability in lunary-ai/lunary

• Severity: critical (CVSS 9.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2024-04-16 · updated 2026-06-17
• Weakness: CWE-821

Description

lunary-ai/lunary is vulnerable to an authentication issue due to improper validation of email addresses during the signup process. Specifically, the server fails to treat email addresses as case insensitive, allowing the creation of multiple accounts with the same email address by varying the case of the email characters. For example, accounts for 'abc@gmail.com' and 'Abc@gmail.com' can both be created, leading to potential impersonation and confusion among users.

Affected products

• lunary-ai/lunary: before 1.0.2 — fixed in 1.0.2

How to fix

Upgrade to a fixed version: lunary-ai/lunary 1.0.2. Check the vendor advisory for mitigations.

References

• https://github.com/lunary-ai/lunary/commit/7351157a21e5acd0162b4528bcae9d65b1c95695
• https://huntr.com/bounties/2ca70ba5-b6a4-4873-bd55-bc6cef40d300
• https://github.com/lunary-ai/lunary/commit/7351157a21e5acd0162b4528bcae9d65b1c95695
• https://huntr.com/bounties/2ca70ba5-b6a4-4873-bd55-bc6cef40d300

Get alerted when CVE-2024-1739 or the next vulnerability affects your stack