CVE-2026-21484

CVE-2026-21484 is a username enumeration vulnerability affecting AnythingLLM, an application designed to provide context for LLMs. The flaw exists in the password recovery endpoint, which returns distinct error messages based on whether a username is valid, allowing attackers to identify existing user accounts. Rated as Medium severity (CVSS 5.3), this vulnerability can be exploited remotely with low complexity and no user interaction, potentially leading to information disclosure. There is currently no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.