CVE-2025-63388 - Dify CORS Misconfiguration Vulnerability

CVE ID : CVE-2025-63388 Published : Dec. 18, 2025, 4:15 p.m. | 1 hour, 30 minutes ago Description : A Cross-Origin Resource Sharing (CORS) misconfiguration vulnerability exists in Dify v1.9.1 in the /console/api/system-features endpoint. The endpoint implements an overly permissive CORS policy that reflects arbitrary Origin headers and sets Access-Control-Allow-Credentials: true, allowing any external domain to make authenticated cross-origin requests. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Source: Telegram CVE Monitor