CVE-2025-63386: Critical severity Dify vulnerability
A Cross-Origin Resource Sharing (CORS) misconfiguration vulnerability exists in Dify v1.9.1 in the /console/api/setup endpoint. The endpoint implements an insecure CORS policy that reflects any Origin header and enables Access-Control-Allow-Credentials: true, permitting arbitrary external domains to make authenticated requests. NOTE: the Supplier disputes this because the endpoint configuration is intentional to support bootstrap.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-63386?
CVE-2025-63386 has been classified with a high severity due to the potential for unauthorized cross-origin requests.
How do I fix CVE-2025-63386?
To fix CVE-2025-63386, update Dify to the latest version that addresses the insecure CORS policy.
What software versions are affected by CVE-2025-63386?
CVE-2025-63386 affects Dify version 1.9.1 and potentially earlier versions.
What impact does CVE-2025-63386 have on users?
CVE-2025-63386 can allow attackers to exploit the CORS misconfiguration to perform unauthorized actions on behalf of users.
Is there a workaround for CVE-2025-63386 before a fix is available?
A temporary workaround for CVE-2025-63386 is to restrict the allowed origins in the CORS policy until a patch is applied.