CVE-2024-3102: Mintplexlabs AnythingLLM Auth Bypass Vulnerability

CVE-2024-3102 Overview

CVE-2024-3102 is a JSON Injection vulnerability in the mintplex-labs/anything-llm application. The flaw resides in the username parameter processed by the /api/request-token endpoint during authentication. Improper handling of input values allows attackers to pass structured objects instead of strings into the Prisma query layer. This behavior enables brute-force attacks without prior knowledge of valid usernames. Once a password is known, attackers can perform blind queries to enumerate usernames, undermining account confidentiality. The vulnerability is tracked under [CWE-307: Improper Restriction of Excessive Authentication Attempts].

Critical Impact

Attackers can abuse Prisma query expansion through the username field to enumerate valid credentials over the network without authentication.

Affected Products

• mintplex-labs anything-llm (versions prior to the patched commit 2374939)
• Self-hosted AnythingLLM deployments exposing /api/request-token
• Multi-user mode installations where login requests reach SystemSettings.isMultiUserMode()

Discovery Timeline

• 2024-06-06 - CVE-2024-3102 published to the National Vulnerability Database (NVD)
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-3102

Vulnerability Analysis

AnythingLLM uses Prisma as its ORM for user lookups. The /api/request-token endpoint accepts JSON input and forwards the raw username value into User.get({ username }). Prisma interprets object values as query operators, so a JSON payload such as {"username": {"contains": "a"}} is translated into a LIKE-style query rather than an exact string match.

An attacker can submit crafted objects to confirm whether any user whose name matches a pattern exists. By chaining responses with password submissions, the attacker can brute-force both the username and the password without prior account knowledge. The issue applies to deployments running in multi-user mode.

Root Cause

The root cause is missing type coercion before passing user-controlled data into the Prisma query. The server trusts that username is a string and never validates the JavaScript type. Because Prisma treats objects as filter directives, operator injection becomes trivial through standard JSON request bodies.

Attack Vector

Exploitation requires only unauthenticated network access to the /api/request-token endpoint. An attacker sends a POST request with a JSON body where username is an object containing Prisma filter operators such as startsWith, contains, or not. Differential responses or timing variations between known and unknown usernames enable blind enumeration.

// Patch from server/endpoints/system.js
// Source: https://github.com/mintplex-labs/anything-llm/commit/2374939ffb551ab2929d7f9d5827fe6597fa8caa

if (await SystemSettings.isMultiUserMode()) {
  const { username, password } = reqBody(request);
- const existingUser = await User.get({ username });
+ const existingUser = await User.get({ username: String(username) });

  if (!existingUser) {
    await EventLogs.logEvent(

The fix wraps the incoming username value in String(), forcing primitive coercion before the Prisma query runs. Any object payload is converted to its string representation, which eliminates operator injection.

Detection Methods for CVE-2024-3102

Indicators of Compromise

• POST requests to /api/request-token where the username field in the JSON body is a nested object rather than a string.
• Repeated login requests from a single source iterating through alphabetical or regex-like patterns.
• Elevated authentication failure counts in EventLogs without matching successful logins.

Detection Strategies

• Inspect application logs for request bodies containing Prisma filter keywords such as contains, startsWith, endsWith, or not inside the username field.
• Alert on high-volume access to /api/request-token from unauthenticated sources within short time windows.
• Compare observed request body schemas against the expected string type for authentication fields using a web application firewall (WAF).

Monitoring Recommendations

• Enable verbose request logging on the AnythingLLM reverse proxy to capture raw JSON bodies for the login endpoint.
• Forward authentication events to a central logging platform and correlate failed logins against source IP and user-agent fingerprints.
• Monitor the EventLogs table for sustained bursts of failed_login_invalid_username events.

How to Mitigate CVE-2024-3102

Immediate Actions Required

• Upgrade AnythingLLM to a build containing commit 2374939 or later.
• Restrict public exposure of the /api/request-token endpoint behind a reverse proxy or VPN until the upgrade completes.
• Rotate passwords for any administrator or multi-user accounts suspected to have been probed.

Patch Information

The maintainers resolved the vulnerability by casting the username parameter to a string before invoking User.get() in server/endpoints/system.js. Review the GitHub Commit Reference and the Huntr Vulnerability Bounty disclosure for additional context.

Workarounds

• Place a WAF rule in front of /api/request-token that rejects requests where username is not a JSON string primitive.
• Enforce rate limiting on authentication endpoints to slow brute-force enumeration.
• Disable multi-user mode on deployments that do not require it until the patched version is installed.

# Example NGINX snippet to rate-limit login attempts
limit_req_zone $binary_remote_addr zone=anythingllm_login:10m rate=5r/m;

location /api/request-token {
    limit_req zone=anythingllm_login burst=5 nodelay;
    proxy_pass http://anythingllm_backend;
}