CVE-2025-63386 Security Advisory - CORS Misconfiguration in Dify

CVE-2025-63386-Disclosure.md

Security Advisory: CVE-2025-63386 - CORS Misconfiguration in Dify Setup Endpoint

CVE ID: CVE-2025-63386 Date: 2025-12-18 Vendor: LangGenius (Dify) Product: Dify Affected Versions: v1.9.1 Vulnerability Type: Insecure Permissions / CORS Misconfiguration Severity: Medium (Information Disclosure)

Summary

A Cross-Origin Resource Sharing (CORS) misconfiguration vulnerability exists in Dify v1.9.1 in the /console/api/setup endpoint. The endpoint implements an insecure CORS policy that reflects any Origin header and enables Access-Control-Allow-Credentials: true, permitting arbitrary external domains to make authenticated requests.

Vulnerability Details

• Component: /console/api/setup API endpoint, Dify console application
• Vulnerability: The application blindly reflects the Origin header from the request in the Access-Control-Allow-Origin response header and sets Access-Control-Allow-Credentials to true.

Attack Vector & Impact

Attack Type: Remote

Attack Vectors: An attacker can create a malicious website that performs cross-origin requests to the vulnerable setup endpoint. When an authenticated administrator or user visits the attacker's website, the malicious page can retrieve installation and setup information due to the misconfigured CORS policy allowing arbitrary origins with credential inclusion.

Impact:

• Information Disclosure: Attackers can retrieve sensitive installation and setup information.

References

• Vendor Repository: https://github.com/langgenius/dify
• Discussions: https://github.com/langgenius/dify/discussions

Credits

Discovered and reported by Zhihuang Liu (herecristliu@gmail.com)