CVE-2025-63388: Critical severity Dify dify vulnerability
A Cross-Origin Resource Sharing (CORS) misconfiguration vulnerability exists in Dify v1.9.1 in the /console/api/system-features endpoint. The endpoint implements an overly permissive CORS policy that reflects arbitrary Origin headers and sets Access-Control-Allow-Credentials: true, allowing any external domain to make authenticated cross-origin requests. NOTE: the Supplier disputes this, providing the rationale of "sending requests with credentials does not provide any additional access compared to unauthenticated requests."
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update the CORS configuration for /console/api/system-features to stop reflecting arbitrary Origin values and avoid allowing authenticated cross-origin requests by setting Access-Control-Allow-Credentials to false (or only enabling it for explicitly allowlisted origins).
Dify (/console/api/system-features endpoint) CORS policy (Access-Control-Allow-Origin and Access-Control-Allow-Credentials) = Do not reflect arbitrary Origin headers; set Access-Control-Allow-Credentials to false or only allow specific trusted origins - Operational
After changing the CORS policy, test the /console/api/system-features endpoint to confirm that requests from untrusted external origins are rejected and that authenticated cross-origin requests are no longer permitted.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-63388?
CVE-2025-63388 is considered a high-severity vulnerability due to the potential for abuse of the vulnerable CORS policy.
How do I fix CVE-2025-63388?
To fix CVE-2025-63388, configure the CORS policy to restrict the allowed origins and ensure Access-Control-Allow-Credentials is set to false.
Which versions of Dify are affected by CVE-2025-63388?
Dify version 1.9.1 is affected by CVE-2025-63388 due to its misconfigured CORS policy.
What type of vulnerability is CVE-2025-63388?
CVE-2025-63388 is a Cross-Origin Resource Sharing (CORS) misconfiguration vulnerability.
What are the risks associated with CVE-2025-63388?
The risks associated with CVE-2025-63388 include unauthorized access to sensitive data and the potential for cross-origin attacks.