CVE-2025-63386 - Dify CORS Misconfiguration Vulnerability

CVE ID : CVE-2025-63386 Published : Dec. 18, 2025, 4:15 p.m. | 1 hour, 30 minutes ago Description : A Cross-Origin Resource Sharing (CORS) misconfiguration vulnerability exists in Dify v1.9.1 in the /console/api/setup endpoint. The endpoint implements an insecure CORS policy that reflects any Origin header and enables Access-Control-Allow-Credentials: true, permitting arbitrary external domains to make authenticated requests. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Source: Telegram CVE Monitor