CRITICAL🇵🇱 Wersja polska

CVE-2025-63388

CVSS 9.1v3.1pub. 2025-12-18upd. 2026-01-28

A Cross-Origin Resource Sharing (CORS) misconfiguration vulnerability exists in Dify v1.9.1 in the /console/api/system-features endpoint. The endpoint implements an overly permissive CORS policy that reflects arbitrary Origin headers and sets Access-Control-Allow-Credentials: true, allowing any external domain to make authenticated cross-origin requests. NOTE: the Supplier disputes this, providing the rationale of "sending requests with credentials does not provide any additional access compared to unauthenticated requests."

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

  • Langgenius Dify

    APP
    Langgenius
    1.9.1
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2025-56157CRITICAL9.8PL ✓ten sam produkt

Domyślne dane uwierzytelniające PostgreSQL w Langgenius Dify

CVE-2025-63386CRITICAL9.1PL ✓ten sam produkt

Błędna konfiguracja CORS w Dify — endpoint /console/api/setup

CVE-2025-63387HIGH7.5ten sam produkt

Dify v1.9.1 is vulnerable to Insecure Permissions. An unauthenticated attacker can directly send HTTP GET requ...

CVE-2025-3466HIGH7.2ten sam produkt

langgenius/dify versions 1.1.0 to 1.1.2 are vulnerable to unsanitized input in the code node, allowing executi...

CVE-2025-43862HIGH7.6ten sam produkt

Dify is an open-source LLM app development platform. Prior to version 0.6.12, a normal user is able to access ...