- Description
- A critical authentication bypass vulnerability exists in Ollama platform's API endpoints in versions prior to and including v0.12.3. The platform exposes multiple API endpoints without requiring authentication, enabling remote attackers to perform unauthorized model management operations.
- Source
- cve@mitre.org
- NVD status
- Modified
- Products
- ollama
CVSS 3.1
- Type
- Secondary
- Base score
- 9.8
- Impact score
- 5.9
- Exploitability score
- 3.9
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Severity
- CRITICAL
- 134c704f-9b21-4f2e-91b3-4a467353bcc0
- CWE-306
- Hype score
- Not currently trending
CVE-2025-63389 A critical authentication bypass vulnerability exists in Ollama platform's API endpoints in versions prior to and including v0.12.3. The platform exposes multiple API… https://t.co/BCTCvaPcDT
@CVEnew
20 Dec 2025
82 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
Ollama Platform affected by missing authentication (CVE-2025-63389), allowing unauthorized model management. Secure API access and monitor for official updates. https://t.co/rg5ROC6dOn
@pulsepatchio
19 Dec 2025
5 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
[
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ollama:ollama:*:*:*:*:*:*:*:*",
"matchCriteriaId": "ECF7F9A4-2538-4FCE-8BBB-7EB95E91D756",
"versionEndIncluding": "0.12.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
]