Auth bypass in Microsoft Windows
CVE-2024-8196
In mintplex-labs/anything-llm v1.5.11 desktop version for Windows, the application opens server port 3001 on 0.0.0.0 with no authentication by default. This vulnerability allows an attacker to gain full backend access, enabling them to perform actions such as deleting all data from the workspace.
Vulnerability class: Broken Authentication
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.008 (55.8th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 56th percentile — 55.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.008 · newest: 0.008 · change: +0.000
Affected products
- Microsoft Windows
- Mintplex-Labs Mintplex-Labs/anything-Llm — versions unspecified
- Mintplexlabs Anythingllm Desktop
Weakness classification (CWE)
References
- huntr.com/bounties/dbde1c71-7aa5-46f6-847a-d89793cf97a9 (Exploit, Third Party Advisory)
- github.com/mintplex-labs/anything-llm/commit/9bfe477f10b188bfe3508ac29105df80d4… (Patch)
Frequently asked questions
- What is CVE-2024-8196?
- CVE-2024-8196 is a critical-severity vulnerability in Microsoft Windows, classified under Missing Authentication for Critical Function. CVSS score: 9.8/10. Published 2025-03-20.
- How severe is CVE-2024-8196?
- Critical severity. CVSS v3 base score is 9.8 out of 10.