What’s Vulnerable › Vulnerabilities

CVE-2025-63390

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-12-18 · updated 2026-10-13
• Weakness: CWE-306

Description

An authentication bypass vulnerability exists in AnythingLLM v1.8.5 in via the /api/workspaces endpoint. The endpoint fails to implement proper authentication checks, allowing unauthenticated remote attackers to enumerate and retrieve detailed information about all configured workspaces. Exposed data includes: workspace identifiers (id, name, slug), AI model configurations (chatProvider, chatModel, agentProvider), system prompts (openAiPrompt), operational parameters (temperature, history length, similarity thresholds), vector search settings, chat modes, and timestamps.

Affected products

• Mintplexlabs Anythingllm: 1.8.5

References

• https://gist.github.com/Cristliu/0897bceac5fdc2d945304b5087a84f14
• https://gist.github.com/Cristliu/ba529c99abec87102e5ef36435d02a6d
• https://github.com/Mintplex-Labs/anything-llm/issues

Get alerted when CVE-2025-63390 or the next vulnerability affects your stack