AnythingLLMPublished 29 Oct 2024NVD status: Analyzed

CVE-2024-7783

AnythingLLM: mintplex-labs/anything-llm version latest contains a vulnerability where sensitive information, specifically a password, is improperly stored within a JWT (JSON Web Token) used as a bearer token in single user mode.

ComponentAnythingLLM
Severityhigh (CVSS 7.5)
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Published (NVD)2024-10-29
Last modified2026-06-17
Affected versions
< 1.0.3
from the CVE Program record written by the CNA that assigned the CVE
NVD's CPE data says otherwise on some releases, where a more reliable source, or two others together, contradict it
Fixed in1.0.3
WeaknessCWE-312
CISA KEVnot listed

NVD description

mintplex-labs/anything-llm version latest contains a vulnerability where sensitive information, specifically a password, is improperly stored within a JWT (JSON Web Token) used as a bearer token in single user mode. When decoded, the JWT reveals the password in plaintext. This improper storage of sensitive information poses significant security risks, as an attacker who gains access to the JWT can easily decode it and retrieve the password. The issue is fixed in version 1.0.3.

What to do

  • Upgrade AnythingLLM to 1.0.3 or later.
  • Do not expose the component's API or UI to the internet without authentication in front of it.

Sources