Auth bypass in Microsoft Windows
CVE-2024-8196
In mintplex-labs/anything-llm v1.5.11 desktop version for Windows, the application opens server port 3001 on 0.0.0.0 with no authentication by default. This vulnerability allows an attacker to gain full backend access, enabling them to perform actions such as deleting all data from the workspace.
Vulnerability class: Broken Authentication
EPSS: 0.008 (52.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Microsoft Windows
- Mintplex-labs Mintplex-labs/anything-llm — versions unspecified
- Mintplexlabs Anythingllm_desktop
Weakness classification (CWE)
References
- security@huntr.dev (Exploit, Third Party Advisory)
- security@huntr.dev (Patch)
Frequently asked questions
- What is CVE-2024-8196?
- CVE-2024-8196 is a critical-severity vulnerability in Microsoft Windows, classified under Missing Authentication for Critical Function. CVSS score: 9.8/10. Published 2025-03-20.
- How severe is CVE-2024-8196?
- Critical severity. CVSS v3 base score is 9.8 out of 10.