CVE-2025-65107CWE-285CWE-352csrf

CVE-2025-65107

Medium · published November 22, 2025

CVSS v3.1
6.5
EPSS
0%
Percentile
5.6
In the wild
Unconfirmed
What it is

Langfuse is an open source large language model engineering platform. In versions from 2.95.0 to before 2.95.12 and from 3.17.0 to before 3.131.0, in SSO provider configurations without an explicit AUTH_<PROVIDER>_CHECK setting, a potential account takeover may happen if an authenticated user is made to call a specifically crafted URL via a CSRF or phishing attack. This issue has been patched in versions 2.95.12 and 3.131.0. A workaround for this issue involves setting AUTH_<PROVIDER>_CHECK.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00167 · 5.6th percentile
Weaknesses
CWE-285 · Improper Authorization; CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2025-11-22T03:16Z
Affected products (2)
ProductVersionsFixed in
langfuse/langfuse≥ 2.95.0, < 2.95.122.95.12
langfuse/langfuse≥ 3.17.0, < 3.131.03.131.0
References (1)
https://github.com/langfuse/langfuse/security/advisories/GHSA-w9pw-c549-5m6w · [email protected]
EPSS history
Timeline
  • 21 NOV 21:49Z
    Langfuse SSO Account Takeover via CSRF or phishing attack
    cvelistv5