An authentication bypass vulnerability exists in AnythingLLM v1.8.5 in via the /api/workspaces endpoint. The endpoint fails to implement proper authentication checks, allowing unauthenticated remote attackers to enumerate and retrieve detailed information about all configured workspaces. Exposed data includes: workspace identifiers (id, name, slug), AI model configurations (chatProvider, chatModel, agentProvider), system prompts (openAiPrompt), operational parameters (temperature, history length, similarity thresholds), vector search settings, chat modes, and timestamps.
References
| Link | Resource |
|---|---|
| https://gist.github.com/Cristliu/ba529c99abec87102e5ef36435d02a6d | Third Party Advisory |
| https://github.com/Mintplex-Labs/anything-llm/issues | Issue Tracking |
Configurations
History
30 Dec 2025, 19:59
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Mintplexlabs
Mintplexlabs anythingllm |
|
| References | () https://gist.github.com/Cristliu/ba529c99abec87102e5ef36435d02a6d - Third Party Advisory | |
| References | () https://github.com/Mintplex-Labs/anything-llm/issues - Issue Tracking | |
| CPE | cpe:2.3:a:mintplexlabs:anythingllm:1.8.5:*:*:*:*:*:*:* |
19 Dec 2025, 22:15
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-306 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.3 |
18 Dec 2025, 16:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-12-18 16:15
Updated : 2025-12-30 19:59
NVD link : CVE-2025-63390
Mitre link : CVE-2025-63390
CVE.ORG link : CVE-2025-63390
JSON object : View
Products Affected
mintplexlabs
- anythingllm
CWE
CWE-306
Missing Authentication for Critical Function