CVE-2025-51471 | Teknoloji dünyasından en güncel haberleri ve güvenlikle ilgili gelişmeleri takip edin.

Cross-Domain Token Exposure in server.auth.getAuthorizationToken in Ollama 0.6.7 allows remote attackers to steal authentication tokens and bypass access contro…
Medium CVSS: 6.9

CVE-2025-51471

Cross-Domain Token Exposure in server.auth.getAuthorizationToken in Ollama 0.6.7 allows remote attackers to steal authentication tokens and bypass access controls via a malicious realm value in a WWW-Authenticate header returned by the /api/pull endpoint.
Vendor
Ollama
Product
Ollama
CWE
CWE-345
Yayın Tarihi
2025-07-22 19:15:25
Güncelleme
2025-10-17 18:15:36
Source Identifier
cve@mitre.org
KEV Date Added
-

Kategoriler

CWE-345 Ollama MEDIUM Ollama 2025

Referanslar

https://github.com/ollama/ollama https://github.com/ollama/ollama/pull/10750 https://huntr.com/bounties/94eea285-fd65-4e01-a035-f533575ebdc2 https://www.gecko.security/blog/cve-2025-51471