CVE-2025-34291 is a critical-severity vulnerability, listed in the CISA KEV catalog. AttackerView checks Langflow sites for it with a live exploit check.
Detects Langflow instances that hand any website permission to use a logged-in user's session. Langflow ships its API with a wildcard CORS origin and credentials allowed at the same time. A server cannot answer a cookie-bearing request with a wildcard, so the framework quietly upgrades the wildcard into an explicit grant for whichever origin asked, and the answer comes back with access-control-allow-credentials set to true. The refresh cookie is written SameSite=none with a one week lifetime, so a browser attaches it to cross-site requests, and the refresh endpoint exchanges that cookie alone for a fresh access token. Any page a logged-in user opens can therefore read a working token for their account, and the token reaches every authenticated endpoint including the code validation route that executes submitted Python. The check is three requests to the refresh endpoint: one as a cross-origin caller from a hostname minted for the scan, one without the cookie to show the wildcard the grant is upgraded from, and one without an Origin header as a control. The finding is raised only when the server names our random origin and allows credentials, and the probe presents a token of its own rather than a real user's, so no session is touched and nothing is written. CVSS 8.8, scored 9.4 under CVSS 4.0 by the disclosing researcher, and listed by CISA as known exploited. Upgrade Langflow to 1.10.1 or later and set LANGFLOW_CORS_ORIGINS to the exact origins your front end is served from.
Is your app exploitable through CVE-2025-34291?
Scan your domain free