CVE-2025-63388 Misconfiguration in n/a

Critical 9.1 Published 18 Dec 2025 Updated 28 Jan 2026

An overly permissive CORS policy in Dify allows external domains to make authenticated cross-origin requests, potentially exposing sensitive data.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-63388?

CVE-2025-63388 is a critical vulnerability in n/a, published on 18 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A Cross-Origin Resource Sharing (CORS) misconfiguration vulnerability exists in Dify v1.9.1 in the /console/api/system-features endpoint. The endpoint implements an overly permissive CORS policy that reflects arbitrary Origin headers and sets Access-Control-Allow-Credentials: true, allowing any external domain to make authenticated cross-origin requests. NOTE: the Supplier disputes this, providing the rationale of "sending requests with credentials does not provide any additional access compared to unauthenticated requests."

Weakness: CWE-346

Which versions are affected by CVE-2025-63388?

It affects 1 product.

Products include Langgenius Dify.

How do I fix CVE-2025-63388?

No fix has been published for CVE-2025-63388 yet. Limit exposure of the affected software until one is available.

Is CVE-2025-63388 being exploited?

There is no known exploitation of CVE-2025-63388 in the wild and no public exploit code.

Sources

Also known as GHSA-96g3-r54f-fx2v.