{"data":{"id":"f9bdb224-36f3-460d-949a-eae4cf459280","title":"CVE-2025-63389: A critical authentication bypass vulnerability exists in Ollama platform's API endpoints in versions prior to and…","summary":"CVE-2025-63389 is a critical authentication bypass in the API endpoints of the Ollama platform, affecting versions prior to and including v0.12.3. The platform exposes multiple API endpoints without requiring authentication, which lets remote attackers perform unauthorized model management operations. The weakness is classified as CWE-306, Missing Authentication for Critical Function.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-63389","publishedAt":"2025-12-18T21:15:54.760Z","cveId":"CVE-2025-63389","cweIds":["CWE-306"],"cvssScore":"9.8","cvssSeverity":"critical","severity":"critical","attackType":["other"],"issueType":"vulnerability","affectedPackages":["github.com/ollama/ollama@<= 0.13.5"],"affectedPackageNames":["github.com/ollama/ollama"],"affectedPackageRefs":["go:github.com/ollama/ollama"],"affectedVendors":[],"affectedVendorsRaw":["Ollama"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Ollama API endpoints missing authentication enable unauthorized model management","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00708,"epssCheckedAt":"2026-11-04T06:10:14.105Z","kevDateAdded":null,"advisoryAliases":["GHSA-f6mr-38g8-39rg"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:51:39.695Z","patchAvailable":null,"disclosureDate":null,"fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":["CAPEC-115"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"api","llmSpecific":false,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":null,"fixes":[]}}