Lumiverse, an AI chat application by prolix-oc, had a race condition vulnerability (CWE-362) in versions before 0.9.7 related to nonce consumption during user sign-up. The consumeNonce() function did not validate the nonce against the HTTP request or bind it to the admin session, leading to a 10-second window where an attacker could race to register unauthorized accounts if they could predict or observe admin user creation attempts. This occurs because if the admin's sign-up email call fails early, the nonce remains set but unconsumed, allowing subsequent POST requests to succeed improperly. The issue is resolved in Lumiverse 0.9.7.

An attacker able to observe or predict when an admin is creating users can exploit this race condition to register unauthorized accounts during a 10-second window. The vulnerability allows unauthorized user registration but does not directly impact confidentiality or availability. The CVSS score of 4.8 (medium severity) reflects limited impact with network attack vector, high attack complexity, no privileges required, and low confidentiality and integrity impact.

This vulnerability is fixed in Lumiverse version 0.9.7. Users should upgrade to version 0.9.7 or later to remediate this issue. Patch status is not explicitly confirmed in the vendor advisory, but the description states the vulnerability is fixed in 0.9.7. Until upgrading, be aware of the risk of unauthorized user registrations during the race window.