Critical · published December 18, 2025
🚨 A CORS misconfiguration in Dify v1.9.1 could let any external site craft requests and access your data as if they were your app! 🔥 Imagine a restaurant that allows any delivery service to collect your takeout order without checking their credentials — that’s what this vulnerability does for unauthorized domains! This means an attacker could masquerade as a trusted site and gain access to sensitive user data, making authenticated requests that could compromise not just your application, but your users’ privacy too. It’s a recipe for disaster if left unaddressed!
Imagine a restaurant that allows any delivery service to collect your takeout order without checking their credentials — that’s what this vulnerability does for unauthorized domains! The vulnerability arises from the /console/api/setup endpoint reflecting any Origin header and enabling Access-Control-Allow-Credentials: true, which allows arbitrary external domains to make authenticated requests to your server.
This means an attacker could masquerade as a trusted site and gain access to sensitive user data, making authenticated requests that could compromise not just your application, but your users’ privacy too. It’s a recipe for disaster if left unaddressed! To secure your application, update Dify to the latest version and configure a strict CORS policy that only allows trusted domains. Ensure that Access-Control-Allow-Credentials is set to false unless absolutely necessary! You’ve got this! Follow these steps to secure your app and keep your users safe. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| langgenius/dify | all versions | — |