CORS Misconfiguration Vulnerability in Dify by LangGenius
CVE-2025-63388

9.1CRITICAL

Key Information:

Vendor

LangGenius

Status
Dify
Vendor
CVE Published:
18 December 2025

What is CVE-2025-63388?

A misconfiguration vulnerability in Dify v1.9.1 allows for overly permissive Cross-Origin Resource Sharing (CORS) settings within the /console/api/system-features endpoint. This issue enables the software to respond to arbitrary Origin headers and allows the Access-Control-Allow-Credentials header to be set to true. As a result, any external domain can perform authenticated cross-origin requests, potentially exposing sensitive information and compromising the security of web applications using this product.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

References

https://github.com/langgenius/dify/discussions
https://gist.github.com/Cristliu/5ded6d03e41d7d66ecb1b568...
https://gist.github.com/Cristliu/c2bc7d05abd89db8eb542a45...

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.