CORS Misconfiguration Vulnerability in Dify by LangGenius
CVE-2025-63388
Currently unrated
What is CVE-2025-63388?
A misconfiguration vulnerability in Dify v1.9.1 allows for overly permissive Cross-Origin Resource Sharing (CORS) settings within the /console/api/system-features endpoint. This issue enables the software to respond to arbitrary Origin headers and allows the Access-Control-Allow-Credentials header to be set to true. As a result, any external domain can perform authenticated cross-origin requests, potentially exposing sensitive information and compromising the security of web applications using this product.