CVE-2025-69286: RAGFlow has Predictable Token Generation Leading to Authentication Bypass Vulnerability
RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. In versions prior to 0.22.0, the use of an insecure key generation algorithm in the API key and beta (assistant/agent share auth) token generation process allows these tokens to be mutually derivable. Specifically, both tokens are generated using the same URLSafeTimedSerializer with predictable inputs, enabling an unauthorized user who obtains the shared assistant/agent URL to derive the personal API key. This grants them full control over the assistant/agent owner's account. Version 0.22.0 fixes the issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-69286?
CVE-2025-69286 has been classified with a moderate severity due to the potential exposure of API keys and tokens.
How do I fix CVE-2025-69286?
To remediate CVE-2025-69286, upgrade RAGFlow to version 0.22.0 or later.
What versions are affected by CVE-2025-69286?
CVE-2025-69286 affects RAGFlow versions prior to 0.22.0.
What is the root cause of CVE-2025-69286?
The root cause of CVE-2025-69286 is the use of an insecure key generation algorithm for API and token generation.
What impact does CVE-2025-69286 have on security?
CVE-2025-69286 allows tokens to be mutually derivable, which can lead to unauthorized access.