CVE-2025-34291
Description
Langflow versions up to and including 1.6.9 contain a chained vulnerability that enables account takeover and remote code execution. An overly permissive CORS configuration (allow_origins='*' with allow_credentials=True) combined with a refresh token cookie configured as SameSite=None allows a malicious webpage to perform cross-origin requests that include credentials and successfully call the refresh endpoint. An attacker-controlled origin can therefore obtain fresh access_token / refresh_token pairs for a victim session. Obtained tokens permit access to authenticated endpoints — including built-in code-execution functionality — allowing the attacker to execute arbitrary code and achieve full system compromise.
Summary dbcve.org
Langflow versions up to 1.6.9 have a chained vulnerability combining permissive CORS (allow_origins='*' with allow_credentials=True) and a refresh token cookie with SameSite=None. This allows a malicious page to make cross-origin requests that include credentials, obtain fresh access/refresh tokens for victim sessions, and access authenticated endpoints including built-in code execution functionality for arbitrary code execution and full system compromise.
Mitigation
Restrict CORS to explicit allowed origins (remove wildcard) and set the refresh token cookie SameSite attribute to Strict or Lax instead of None to prevent cross-origin credential leakage.