CVE-2025-34291: Langflow Origin Validation Error Allows Credential Theft via Over‑Permissive CORS

CVE-2025-34291: Langflow Origin Validation Error – Over‑Permissive CORS & SameSite=None Cookie Leads to Credential‑Theft and Full System Compromise

What It Is – Langflow’s web UI ships with an overly permissive Cross‑Origin Resource Sharing (CORS) policy. Coupled with a refresh‑token cookie set to SameSite=None, a malicious site can issue cross‑origin requests that include credentials and call the token‑refresh endpoint.

Exploitability – The flaw is publicly disclosed (CVE‑2025‑34291) and can be weaponised without prior access; a proof‑of‑concept exists. CVSS v3.1 is rated 8.6 (High).

Affected Products – Langflow (all versions prior to the vendor‑issued patch).

Why It Matters for Trust & Control Assurance

• Control Mapping – The issue maps to the “Secure Configuration Management” control area, a single objective that satisfies requirements across NIST CSF, ISO 27001, and SOC 2.
• Continuous Evidence – Demonstrating that CORS policies and cookie attributes are locked down provides audit‑ready evidence of a defended perimeter.
• Defensible Audit Trail – Remediating and documenting the configuration change creates a traceable control‑execution record that buyers increasingly demand.

Recommended Actions

1. Immediately review and tighten Langflow’s CORS whitelist to allow only trusted origins.
2. Change the refresh‑token cookie SameSite attribute to Lax or Strict and enforce Secure flag.
3. Run automated configuration scans (e.g., CSP, CORS, cookie hygiene) and capture the results as compliance evidence.
4. Deploy a patch or upgrade to the vendor‑released version that resolves CVE‑2025‑34291.
5. Update your control‑mapping inventory to reflect the corrected configuration and retain the evidence for future audits.

Source: CISA KEV – CVE‑2025‑34291