CVE-2025-63388

Critical

Published: 18/12/2025(UTC)Translated: 05/08/2026(UTC)NVD NIST

Summary

CORS misconfiguration vulnerability in Dify v1.9.1 in the /console/api/system-features endpoint. The endpoint reflects arbitrary Origin headers and sets Access-Control-Allow-Credentials: true, allowing any external domain to make authenticated cross-origin requests. NOTE: The supplier disputes this, arguing that credentialed requests do not provide additional access compared to unauthenticated requests.

Risk Assessment

Potential risk of unauthorized access to data or actions in the context of an authenticated user if an attacker exploits CORS to hijack sessions.

Recommendation

Configure a strict CORS policy, restricting allowed origins and disabling Access-Control-Allow-Credentials for sensitive endpoints.

Original NVD description (English source)

A Cross-Origin Resource Sharing (CORS) misconfiguration vulnerability exists in Dify v1.9.1 in the /console/api/system-features endpoint. The endpoint implements an overly permissive CORS policy that reflects arbitrary Origin headers and sets Access-Control-Allow-Credentials: true, allowing any external domain to make authenticated cross-origin requests. NOTE: the Supplier disputes this, providing the rationale of "sending requests with credentials does not provide any additional access compared to unauthenticated requests."