CVE-2025-63390: 
Homebrew vulnerability analysis and mitigation

CVE-2025-63390 is an authentication bypass vulnerability in AnythingLLM v1.8.5, affecting the /api/workspaces endpoint. The endpoint fails to implement proper authentication checks, allowing unauthenticated remote attackers to enumerate and retrieve detailed information about all configured workspaces. It was discovered by Zhihuang Liu and publicly disclosed on December 18, 2025. The vulnerability carries a CVSS v3.1 base score of 5.3 (Medium), classified under CWE-306 (Missing Authentication for Critical Function) (Red Hat CVE, Public Disclosure Gist).

The root cause is CWE-306 (Missing Authentication for Critical Function): the /api/workspaces API endpoint in AnythingLLM v1.8.5 does not enforce authentication middleware, allowing any unauthenticated network request to retrieve workspace data. An attacker can send a simple unauthenticated HTTP GET request to /api/workspaces on an exposed AnythingLLM instance and receive a full JSON response containing workspace identifiers (id, name, slug), AI model configurations (chatProvider, chatModel, agentProvider), system prompts (openAiPrompt), operational parameters (temperature, history length, similarity thresholds), vector search settings, chat modes, and timestamps. No credentials, session tokens, or special privileges are required, and no user interaction is needed (Public Disclosure Gist, Red Hat CVE).

Successful exploitation results in unauthorized information disclosure of sensitive workspace configuration data, including AI model settings, system prompts, and operational parameters. Exposed system prompts may reveal proprietary business logic or sensitive instructions embedded in AI workflows. While the direct impact is limited to confidentiality (no integrity or availability impact), the leaked configuration data — particularly workspace slugs and AI provider details — could facilitate further targeted attacks, such as unauthorized access to workspace resources or abuse of exposed AI agent configurations (Public Disclosure Gist, Red Hat CVE).

No evidence of active in-the-wild exploitation has been reported, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. A public disclosure gist by the researcher (Cristliu) documents the vulnerability details, effectively serving as a proof-of-concept reference. The EPSS score is approximately 0.033%, indicating a low probability of exploitation in the near term. The attack requires no authentication, no user interaction, and low complexity, making it trivially exploitable against any internet-exposed AnythingLLM v1.8.5 instance (Public Disclosure Gist, Red Hat CVE).

1. Reconnaissance: Identify internet-facing AnythingLLM instances running v1.8.5 using tools like Shodan or Censys, searching for the application's default port and web interface fingerprints.
2. Send unauthenticated request: Issue a simple HTTP GET request to the target's /api/workspaces endpoint without any authentication headers or tokens (e.g., curl http://<target>/api/workspaces).
3. Retrieve workspace data: Parse the JSON response, which contains workspace identifiers (id, name, slug), AI model configurations (chatProvider, chatModel, agentProvider), system prompts (openAiPrompt), operational parameters (temperature, history length, similarity thresholds), vector search settings, chat modes, and timestamps.
4. Leverage disclosed information: Use the extracted workspace slugs and configuration details to craft further targeted requests, potentially accessing workspace resources or abusing exposed AI agent configurations (Public Disclosure Gist).

• Network: Unauthenticated HTTP GET requests to /api/workspaces from external or unexpected IP addresses; absence of Authorization headers in requests to this endpoint.
• Logs: Web server or application access logs showing repeated or automated GET requests to /api/workspaces without authentication tokens, particularly from scanning IP ranges or unfamiliar sources.
• Behavioral: Unusual spikes in API request volume to the /api/workspaces endpoint, especially from IPs not associated with known users or internal systems.

Users should upgrade AnythingLLM to a version beyond v1.8.5 that includes proper authentication enforcement on the /api/workspaces endpoint. As an immediate workaround, restrict network access to the AnythingLLM instance using firewall rules or reverse proxy authentication (e.g., require authentication at the proxy layer before requests reach the API). Avoid exposing AnythingLLM instances directly to the internet without additional access controls. Monitor the vendor's GitHub repository for official patches and security advisories (AnythingLLM Issues, Public Disclosure Gist).

The vulnerability was publicly disclosed by researcher Zhihuang Liu via a GitHub Gist on December 18, 2025, and subsequently tracked by Red Hat and INCIBE-CERT. Coverage has been limited to vulnerability aggregators and security advisory databases, with no significant vendor statement or broad community discussion observed at the time of this report (Public Disclosure Gist, Red Hat CVE).