CVE-2025-63390

An authentication bypass vulnerability exists in AnythingLLM v1.8.5 in via the /api/workspaces endpoint. The endpoint fails to implement proper authentication checks, allowing unauthenticated remote attackers to enumerate and retrieve detailed information about all configured workspaces. Exposed data includes: workspace identifiers (id, name, slug), AI model configurations (chatProvider, chatModel, agentProvider), system prompts (openAiPrompt), operational parameters (temperature, history length, similarity thresholds), vector search settings, chat modes, and timestamps.

• CWE-306

• https://gist.github.com/Cristliu/0897bceac5fdc2d945304b5087a84f14
• https://gist.github.com/Cristliu/ba529c99abec87102e5ef36435d02a6dThird Party Advisory
• https://github.com/Mintplex-Labs/anything-llm/issuesIssue Tracking

Published

Dec 18, 2025

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-63384A vulnerability was discovered in RISC-V Rocket-Chip v1.6 an…6.5
• CVE-2025-63386A Cross-Origin Resource Sharing (CORS) misconfiguration vuln…9.1
• CVE-2025-63387Dify v1.9.1 is vulnerable to Insecure Permissions. An unauth…7.5
• CVE-2025-63388A Cross-Origin Resource Sharing (CORS) misconfiguration vuln…9.1
• CVE-2025-63389A critical authentication bypass vulnerability exists in Oll…9.8
• CVE-2025-6339A vulnerability was found in ponaravindb Hospital Management…9.8
• CVE-2025-63391Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: non…
• CVE-2025-63396An issue was discovered in PyTorch v2.5 and v2.7.1. Omission…3.3
• CVE-2025-63397Improper input validation in OneFlow v0.9.0 allows attackers…6.5
• CVE-2025-6340A vulnerability classified as problematic has been found in …5.4
• CVE-2025-63401Cross Site Scripting vulnerability in HCL Technologies Limit…5.5
• CVE-2025-63402An issue in HCL Technologies Limited HCLTech GRAGON before v…5.5