cvedb.io
CVE-2025-63386
CRITICAL · CVSS 9.1
EPSS exploitation probability: 0%
Published 2025-12-18T16:15:54.533 · Last modified 2026-06-17T09:53:04.020

Summary

A Cross-Origin Resource Sharing (CORS) misconfiguration vulnerability exists in Dify v1.9.1 in the /console/api/setup endpoint. The endpoint implements an insecure CORS policy that reflects any Origin header and enables Access-Control-Allow-Credentials: true, permitting arbitrary external domains to make authenticated requests. NOTE: the Supplier disputes this because the endpoint configuration is intentional to support bootstrap.

Affected products

langgenius — dify

Does this affect you?

Add your gear to cvedb and we'll alert you only when langgenius ships something exploited.

Check my exposure →

References

This product uses data from the NVD API but is not endorsed or certified by the NVD. Informational only; not professional security advice.