CVE-2025-34291 PoC — Langflow <= 1.6.9 CORS Misconfiguration to Token Hijack & RCE

Title:Langflow <= 1.6.9 CORS Misconfiguration to Token Hijack & RCE (CVE-2025-34291)
Description:Langflow versions up to and including 1.6.9 contain a chained vulnerability that enables account takeover and remote code execution. An overly permissive CORS configuration (allow_origins='*' with allow_credentials=True) combined with a refresh token cookie configured as SameSite=None allows a malicious webpage to perform cross-origin requests that include credentials and successfully call the refresh endpoint. An attacker-controlled origin can therefore obtain fresh access_token / refresh_token pairs for a victim session. Obtained tokens permit access to authenticated endpoints — including built-in code-execution functionality — allowing the attacker to execute arbitrary code and achieve full system compromise.

Langflow AI versions 1.6.9 and earlier are vulnerable to a CORS misconfiguration that allows any origin to make credentialed requests. Combined with SameSite=None cookies, this enables cross-origin token theft and subsequent remote code execution via the /api/v1/validate/code endpoint.

 id: CVE-2025-34291

info:
  name: Langflow AI <= 1.6.9 - CORS Misconfiguration
  author: 686f6c61
  

...