An unbound sign‑up nonce creates a race condition that lets an attacker create an account during a 10‑second window when the admin's account creation fails before the nonce is consumed. The attacker does not need to bypass authentication; merely sending a sign‑up request during that window registers the account regardless of the caller. This flaw is a classic race condition (CWE‑362) and results in unauthorized access, potentially giving an attacker the ability to bypass restrictions or conduct phishing or credential stuffing attacks with the newly registered account.

The vulnerability exists in Lumiverse versions prior to 0.9.7. All installations of the Lumiverse chat application from the progenitor "prolix‑oc" vendor are affected unless the software has been updated to 0.9.7 or later.

The CVSS score of 4.8 indicates a moderate impact. EPSS is not available, and the vulnerability is not listed in CISA's KEV catalog, implying no widely deployed exploits are known. The attack requires the ability to observe or predict when an admin attempts to create a duplicate user and to send a sign‑up request during the remaining 10‑second window. The likely vector is within the same network or a user of the service who can time requests; it is inferred rather than explicitly stated in the advisory.