CVE-2025-34291

Langflow <= 1.6.9 CORS Misconfiguration to Token Hijack & RCE

HIGH

8.8

CVSS Score

Published: December 5, 2025 at 10:27 PM UTC

Updated: October 15, 2026 at 09:10 PM UTC

2 products affected across 2 vendorsLangflowLangflow

Using Langflow by Langflow?

Get instant alerts when new vulnerabilities affect Langflow - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH8.8

Exploitation

CISA KEV

Exploit prediction

EPSS 93%

SSVC

Active

Actively Exploited

CISA Known Exploited Vulnerabilities (KEV) Catalog

EPSS Score92.8%

EPSS (Exploit Prediction Scoring System) estimates a 92.8% chance this CVE is exploited in the wild within the next 30 days — higher than 100% of all CVEs. It complements CVSS: a high EPSS on a mid-severity CVE can still be urgent.

Langflow contains an origin validation error vulnerability in which an overly permissive CORS configuration combined with a refresh token cookie configured as SameSite=None allows a malicious webpage to perform cross-origin requests that include credentials and successfully call the refresh endpoint. This could allow the attacker to execute arbitrary code and achieve full system compromise via obtained tokens that permit access to authenticated endpoints.

Required Action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Ransomware Use

Unknown

Added to KEV

May 21, 2026

Remediation Due

Jun 4, 2026

144 days overdue

Notes

This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://github.com/langflow-ai/langflow

https://github.com/langflow-ai/langflow/releases/tag/v1.9.3

https://github.com/langflow-ai/langflow/issues/11465#event-25774545848

https://nvd.nist.gov/vuln/detail/CVE-2025-34291

Description

Langflow versions up to and including 1.6.9 contain a chained vulnerability that enables account takeover and remote code execution. An overly permissive CORS configuration (allow_origins='*' with allow_credentials=True) combined with a refresh token cookie configured as SameSite=None allows a malicious webpage to perform cross-origin requests that include credentials and successfully call the refresh endpoint. An attacker-controlled origin can therefore obtain fresh access_token / refresh_token pairs for a victim session. Obtained tokens permit access to authenticated endpoints — including built-in code-execution functionality — allowing the attacker to execute arbitrary code and achieve full system compromise.