CRITICAL🇵🇱 Wersja polska

CVE-2025-63386

CVSS 9.1v3.1pub. 2025-12-18upd. 2026-02-11

A Cross-Origin Resource Sharing (CORS) misconfiguration vulnerability exists in Dify v1.9.1 in the /console/api/setup endpoint. The endpoint implements an insecure CORS policy that reflects any Origin header and enables Access-Control-Allow-Credentials: true, permitting arbitrary external domains to make authenticated requests. NOTE: the Supplier disputes this because the endpoint configuration is intentional to support bootstrap.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

  • Langgenius Dify

    APP
    Langgenius
    1.9.1
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2025-56157CRITICAL9.8PL ✓ten sam produkt

Domyślne dane uwierzytelniające PostgreSQL w Langgenius Dify

CVE-2025-63388CRITICAL9.1PL ✓ten sam produkt

Błędna konfiguracja CORS w Dify — nieograniczony dostęp cross-origin z uwierzytelnieniem

CVE-2025-63387HIGH7.5ten sam produkt

Dify v1.9.1 is vulnerable to Insecure Permissions. An unauthenticated attacker can directly send HTTP GET requ...

CVE-2025-3466HIGH7.2ten sam produkt

langgenius/dify versions 1.1.0 to 1.1.2 are vulnerable to unsanitized input in the code node, allowing executi...

CVE-2025-43862HIGH7.6ten sam produkt

Dify is an open-source LLM app development platform. Prior to version 0.6.12, a normal user is able to access ...