The vulnerability exists in lollms_generation_events.py of parisneo/lollms version 5.9.0. Event handlers such as generate_text, cancel_generation, generate_msg, and generate_msg_from are registered without any authentication or authorization checks. This lets anyone who can connect to the Socket.IO interface invoke these operations, which are resource‑intensive and may alter server state. As a result, an attacker can consume resources, cause a denial of service, corrupt internal state, or trigger race conditions that affect other clients.

Affected by version 5.9.0 of the lollms project maintained by parisneo. The vulnerability resides specifically in the lollms_generation_events.py file and can be exploited on any instance running that version.

The CVSS score of 8.2 indicates high severity, but the EPSS score of less than 1% suggests low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw simply by connecting to the Socket.IO endpoint without authentication, so the risk remains significant for exposed deployments. Organizations with publicly reachable lollms services should treat this vulnerability as high risk and act quickly.