CVE-2025-63386

The /console/api/setup endpoint reflects any value of the Origin header passed by the client and simultaneously returns the Access-Control-Allow-Credentials: true header. This means that the victim's browser will accept the response from any domain controlled by the attacker, including session cookies or other authentication data in the request. An attacker can thus trick a logged-in user into visiting a malicious website that performs an authenticated request to the endpoint in the background. The manufacturer disputes the report, indicating that such configuration is intentional to support the initialization (bootstrap) process.

An attacker can exploit this vulnerability to gain unauthorized access to sensitive data (confidentiality breach) and to modify application configuration (integrity breach) in the context of the victim's authenticated session.

Patches available from the manufacturer should be applied in accordance with the references (see pull request #32224 in the langgenius/dify GitHub repository). It is recommended to restrict the list of allowed origins in the CORS configuration to trusted domains only instead of dynamically reflecting the Origin header, and also to consider disabling the Access-Control-Allow-Credentials flag for publicly accessible endpoints without authentication.

Langgenius Dify v1.9.1 — /console/api/setup endpoint