{"id":"CVE-2025-63386","aliases":["EUVD-2025-204302","GHSA-vjm9-gq46-wc5j"],"status":"disputed","title":"A Cross-Origin Resource Sharing (CORS) misconfiguration vulnerability exists in Dify v1.9.1 in...","description":"A Cross-Origin Resource Sharing (CORS) misconfiguration vulnerability exists in Dify v1.9.1 in the /console/api/setup endpoint. The endpoint implements an insecure CORS policy that reflects any Origin header and enables Access-Control-Allow-Credentials: true, permitting arbitrary external domains to make authenticated requests. NOTE: the Supplier disputes this because the endpoint configuration is intentional to support bootstrap.","severity":{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.00235,"percentile":0.14658,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-346"],"published":"2025-12-18T00:00:00Z","modified":"2026-10-28T02:30:28Z","products":[{"vendor":"langgenius","product":"dify"}],"references":[{"url":"https://github.com/langgenius/dify/discussions","tags":["Issue Tracking","web"]},{"url":"https://gist.github.com/Cristliu/1610daac87c711ac3e0250c58f5cc4f9","tags":["Third Party Advisory","web"]},{"url":"https://gist.github.com/Cristliu/8ad993126be05c9210c71cc7d49fa112","tags":["web"]},{"url":"https://github.com/langgenius/dify/pull/32224","tags":["fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-63386","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-vjm9-gq46-wc5j"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/63xxx/CVE-2025-63386.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-63386","description":"A Cross-Origin Resource Sharing (CORS) misconfiguration vulnerability exists in Dify v1.9.1 in the /console/api/setup endpoint. The endpoint implements an insecure CORS policy that reflects any Origin header and enables Access-Control-Allow-Credentials: true, permitting arbitrary external domains to make authenticated requests. NOTE: the Supplier disputes this because the endpoint configuration is intentional to support bootstrap.","status":"disputed","published":"2025-12-18T00:00:00Z","modified":"2026-02-11T14:09:22.325Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"adp"}],"cwes":["CWE-346"],"updated_at":"2026-11-02T14:32:45.503988Z"}],"euvd":[{"id":"EUVD-2025-204302","description":"A Cross-Origin Resource Sharing (CORS) misconfiguration vulnerability exists in Dify v1.9.1 in the /console/api/setup endpoint. The endpoint implements an insecure CORS policy that reflects any Origin header and enables Access-Control-Allow-Credentials: true, permitting arbitrary external domains to make authenticated requests. NOTE: the Supplier disputes this because the endpoint configuration is intentional to support bootstrap.","status":"published","published":"2025-12-18T00:00:00Z","modified":"2026-02-11T14:09:22Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T19:48:41.30503Z"}],"ghsa":[{"id":"GHSA-vjm9-gq46-wc5j","title":"A Cross-Origin Resource Sharing (CORS) misconfiguration vulnerability exists in Dify v1.9.1 in...","description":"A Cross-Origin Resource Sharing (CORS) misconfiguration vulnerability exists in Dify v1.9.1 in the /console/api/setup endpoint. The endpoint implements an insecure CORS policy that reflects any Origin header and enables Access-Control-Allow-Credentials: true, permitting arbitrary external domains to make authenticated requests.","status":"published","published":"2025-12-18T18:30:30Z","modified":"2026-02-11T15:30:21Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-346"],"updated_at":"2026-11-02T15:06:09.03825Z"}],"nvd":[{"id":"CVE-2025-63386","description":"A Cross-Origin Resource Sharing (CORS) misconfiguration vulnerability exists in Dify v1.9.1 in the /console/api/setup endpoint. The endpoint implements an insecure CORS policy that reflects any Origin header and enables Access-Control-Allow-Credentials: true, permitting arbitrary external domains to make authenticated requests. NOTE: the Supplier disputes this because the endpoint configuration is intentional to support bootstrap.","status":"disputed","published":"2025-12-18T16:15:54.533Z","modified":"2026-10-13T11:10:00.203Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"primary"},{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"secondary"}],"cwes":["CWE-346"],"updated_at":"2026-11-02T14:11:52.309391Z"}],"osv":[{"id":"CVE-2025-63386","description":"A Cross-Origin Resource Sharing (CORS) misconfiguration vulnerability exists in Dify v1.9.1 in the /console/api/setup endpoint. The endpoint implements an insecure CORS policy that reflects any Origin header and enables Access-Control-Allow-Credentials: true, permitting arbitrary external domains to make authenticated requests. NOTE: the Supplier disputes this because the endpoint configuration is intentional to support bootstrap.","status":"published","published":"2025-12-18T00:00:00Z","modified":"2026-10-28T02:30:28.967433302Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:44:51.851511Z"}]}}