CVE-2025-63386

Katalog CVE

CVSS 9.1 · Critical EPSS 0,24%

Kerentanan Origin Validation Error pada langgenius dify. Skor CVSS 3.1 9.1 (Critical) menurut NVD.

Deskripsi (NVD)

A Cross-Origin Resource Sharing (CORS) misconfiguration vulnerability exists in Dify v1.9.1 in the /console/api/setup endpoint. The endpoint implements an insecure CORS policy that reflects any Origin header and enables Access-Control-Allow-Credentials: true, permitting arbitrary external domains to make authenticated requests. NOTE: the Supplier disputes this because the endpoint configuration is intentional to support bootstrap.

Rincian

Terbit di NVD

18 Desember 2025

Terakhir diubah

13 Oktober 2026

Status NVD

Modified

CVSS 3.1

9.1 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-346: Origin Validation Error

EPSS (30 hari)

0,24% peluang dieksploitasi; lebih tinggi dari 13,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://gist.github.com/Cristliu/1610daac87c711ac3e0250c58f5cc4f9 advisory pihak ketiga
• https://gist.github.com/Cristliu/8ad993126be05c9210c71cc7d49fa112
• https://github.com/langgenius/dify/discussions issue tracking
• https://github.com/langgenius/dify/pull/32224