AVID-2026-R1295

Description

Authentication Bypass by Primary Weakness in mintplex-labs/anything-llm (CVE-2023-4898)

Details

Authentication Bypass by Primary Weakness in GitHub repository mintplex-labs/anything-llm prior to 0.0.1.

Reason for inclusion in AVID: CVE-2023-4898 describes a remote authentication bypass in mintplex-labs/anything-llm (prior to 0.0.1). The affected project is an AI-focused library used in AI model tooling/workflows, i.e., a software component commonly involved in building/deploying GP AI systems. This constitutes a software supply-chain vulnerability affecting dependencies/runtimes in AI stacks. The CVE is security-related with public references (NVD entry, commit), providing sufficient signal.

References

Affected or Relevant Artifacts

Developer: mintplex-labs
Deployer: mintplex-labs
Artifact Details:

Type	Name
System	mintplex-labs/anything-llm

Impact

AVID Taxonomy Categorization

Risk domains: Security
SEP subcategories: S0100: Software Vulnerability
Lifecycle stages: L06: Deployment

CVSS

Version	3.0
Vector String	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Base Score	8.2
Base Severity	🔴 High
Attack Vector	NETWORK
Attack Complexity	🟢 Low
Privileges Required	NONE
User Interaction	NONE
Scope	UNCHANGED
Confidentiality Impact	🔴 High
Integrity Impact	🟢 Low
Availability Impact	NONE

CWE

ID	Description
CWE-305	CWE-305 Authentication Bypass by Primary Weakness

Other information

Report Type: Advisory
Credits:
Date Reported: 2023-09-11
Version: 0.3.3
AVID Entry