CVE-2025-61163
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
Cohere North AI v1.1.5 was discovered to contain excessively permissive cross-domain policy with untrusted domains. This occurs via the server failing to validate the Origin header of incoming connection requests.
Risk Assessment
An attacker can exploit this vulnerability to perform cross-site request forgery (CSRF) attacks or data leakage, as the browser may send requests from untrusted domains.
Recommendation
Update North AI to the latest version that includes a fix for this vulnerability. Additionally, configure the server to validate the Origin header and restrict allowed domains.
Other vulnerabilities in Cohere North AI
See all- CVE-2025-61165Critical
An arbitrary file upload vulnerability in the /v1/my_drive/batch_upload component of cohere North AI v1.1.5 allows attackers to execute arbitrary code via uploading a crafted file.
- CVE-2025-61164High
Cohere North AI v1.1.5 was discovered to contain an information leak via the WebSocket Endpoint.
- CVE-2025-61162High
Incorrect access control in Cohere North AI v1.1.5 allows attackers to arbitrarily overwrite user info via a crafted request to the /api/internal/v1/users/{{USER_ID}} endpoint.
Original NVD description (English source)
Cohere North AI v1.1.5 was discovered to contain excessively permissive cross-domain policy with untrusted domains. This occurs via the server failing to validate the Origin header of incoming connection requests.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS