CVE-2025-34291
Langflow Origin Validation Error Vulnerability
Langflow versions up to and including 1.6.9 contain a chained vulnerability that enables account takeover and remote code execution. An overly permissive CORS configuration (allow_origins='*' with allow_credentials=True) combined with a refresh token cookie configured as SameSite=None allows a malicious webpage to perform cross-origin requests that include credentials and successfully call the refresh endpoint. An attacker-controlled origin can therefore obtain fresh access_token / refresh_token pairs for a victim session.
Obtained tokens permit access to authenticated endpoints, including built-in code-execution functionality, allowing the attacker to execute arbitrary code and achieve full system compromise.
HIGH · CVSS 8.8
⚠ CISA KEV
EPSS 0.32746
Act now
- Listed on CISA KEV (known exploited in the wild)
- EPSS ≥ 0.10 - elevated exploitation probability
- EPSS percentile: top 3% of all CVEs by exploitation likelihood
- Public exploit or PoC is available
- SSVC automatable: yes - attacks can be scripted at scale
- CVSS base score ≥ 7.0
Sigma rules0
YARA rules0