In AnythingLLM versions before 1.15.1, the unauthenticated account recovery process in server/utils/PasswordRecovery/index.js uses the recoverAccount() function to deduplicate raw recoveryCodes before trimming whitespace. This incorrect ordering allows a single valid recovery code submitted twice with different surrounding whitespace to satisfy the two-code requirement. Additionally, each normalized code can match the same stored hash, bypassing the need for distinct codes. An attacker with knowledge of a target username and one recovery code can exploit this by calling POST /api/system/recover-account in multi-user mode to obtain a password-reset token, then use POST /api/system/reset-password to take over the account, including administrator accounts.

Successful exploitation allows an unauthenticated attacker to reset the password of any user account, including administrator accounts, leading to full account takeover. This compromises confidentiality and control of the affected accounts. The vulnerability does not impact system availability or integrity beyond account access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the account recovery API if possible and monitor for suspicious password reset activity. Avoid relying solely on recovery codes without additional verification factors.