High · published December 6, 2025
CVSS calls it high at 8.8. It is confirmed in active exploitation. It sits in the 99.8th percentile for exploit probability.
🚨 An overly permissive CORS setting is all it takes for a crafty attacker to seize control! 🔥 Think of it like a restaurant that lets anyone from the street order food for a table inside, but also serves the bill without checking who’s paying — it's a recipe for chaos! With this vulnerability, an attacker could easily obtain fresh access tokens tied to a victim’s session, paving the way to execute arbitrary code on the server. This means they could potentially access sensitive data, manipulate application behavior, or even take over the entire system! Imagine the devastation of losing control over your own application!
Think of it like a restaurant that lets anyone from the street order food for a table inside, but also serves the bill without checking who’s paying — it's a recipe for chaos! This chained vulnerability results from a dangerous combination of overly permissive CORS settings and misconfigured refresh token cookies that allow cross-origin requests with credentials. Malicious webpages can exploit this to call secure endpoints and obtain fresh access tokens.
With this vulnerability, an attacker could easily obtain fresh access tokens tied to a victim’s session, paving the way to execute arbitrary code on the server. This means they could potentially access sensitive data, manipulate application behavior, or even take over the entire system! Imagine the devastation of losing control over your own application! To defend against this, immediately patch to version 1.7.0 or later. Additionally, review and tighten your CORS configuration to limit allowed origins and ensure refresh tokens are set with Appropriate SameSite policies. Don’t forget to audit your application for any other similar vulnerabilities! You’ve got this! With these steps, you’ll secure your application and keep those attackers at bay! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| langflow/langflow | ≤ 1.6.9 | — |