{"data":{"id":"a6e1efd6-7fe0-4058-98a6-4c406ac93cec","title":"CVE-2025-51471: Cross-Domain Token Exposure in server.auth.getAuthorizationToken in Ollama 0.6.7 allows remote attackers to steal…","summary":"CVE-2025-51471 is a cross-domain token exposure flaw in server.auth.getAuthorizationToken in Ollama 0.6.7. A remote attacker who controls a malicious realm value in a WWW-Authenticate header returned by the /api/pull endpoint can steal authentication tokens and bypass access controls. NVD has not yet provided an assessment.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-51471","publishedAt":"2025-07-22T23:15:25.403Z","cveId":"CVE-2025-51471","cweIds":["CWE-345","CWE-384"],"cvssScore":"6.9","cvssSeverity":"medium","severity":"medium","attackType":["other"],"issueType":"vulnerability","affectedPackages":["github.com/ollama/ollama@<= 0.9.6"],"affectedPackageNames":["github.com/ollama/ollama"],"affectedPackageRefs":["go:github.com/ollama/ollama"],"affectedVendors":[],"affectedVendorsRaw":["Ollama"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Ollama cross-domain token exposure in WWW-Authenticate realm handling","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.18528,"epssCheckedAt":"2026-11-04T12:08:35.001Z","kevDateAdded":null,"advisoryAliases":["GHSA-x9hg-5q6g-q3jr"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:53:19.850Z","patchAvailable":null,"disclosureDate":null,"fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity"],"aiComponentTargeted":"api","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[]}}