What’s Vulnerable › Vulnerabilities

CVE-2024-1646: Authentication Bypass in parisneo/lollms-webui

• Severity: high (CVSS 8.2 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2024-04-16 · updated 2026-06-17
• Weakness: CWE-288

Description

parisneo/lollms-webui is vulnerable to authentication bypass due to insufficient protection over sensitive endpoints. The application checks if the host parameter is not '0.0.0.0' to restrict access, which is inadequate when the application is bound to a specific interface, allowing unauthorized access to endpoints such as '/restart_program', '/update_software', '/check_update', '/start_recording', and '/stop_recording'. This vulnerability can lead to denial of service, unauthorized disabling or overriding of recordings, and potentially other impacts if certain features are enabled in the configuration.

Affected products

• parisneo/lollms-webui: before 9.3 — fixed in 9.3

How to fix

Upgrade to a fixed version: parisneo/lollms-webui 9.3. Check the vendor advisory for mitigations.

References

• https://github.com/parisneo/lollms-webui/commit/02e829b5653a1aa5dbbe9413ec84f96caa1274e8
• https://huntr.com/bounties/2f769c46-aa85-4ab8-8b08-fe791313b7ba
• https://github.com/parisneo/lollms-webui/commit/02e829b5653a1aa5dbbe9413ec84f96caa1274e8
• https://huntr.com/bounties/2f769c46-aa85-4ab8-8b08-fe791313b7ba

Get alerted when CVE-2024-1646 or the next vulnerability affects your stack