CVE-2025-65107

Langfuse is an open source large language model engineering platform. In versions from 2.95.0 to before 2.95.12 and from 3.17.0 to before 3.131.0, in SSO provider configurations without an explicit AUTH_<PROVIDER>_CHECK setting, a potential account takeover may happen if an authenticated user is made to call a specifically crafted URL via a CSRF or phishing attack. This issue has been patched in versions 2.95.12 and 3.131.0. A workaround for this issue involves setting AUTH_<PROVIDER>_CHECK.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/langfuse/langfuse/security/advisories/GHSA-w9pw-c549-5m6w	Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:langfuse:langfuse::::::::
	cpe:2.3:a:langfuse:langfuse::::::::

History

19 Oct 2026, 13:10

Type	Values Removed	Values Added
Summary		(es) Langfuse es una plataforma de ingeniería de modelos de lenguaje grandes de código abierto. En las versiones desde la 2.95.0 hasta la 2.95.12 y desde la 3.17.0 hasta la 3.131.0, en configuraciones de proveedor de SSO sin una configuración explícita de AUTH_<PROVIDER>_CHECK, podría ocurrir una posible toma de control de cuenta si se obliga a un usuario autenticado a llamar a una URL específicamente diseñada mediante un ataque de CSRF o phishing. Este problema ha sido parcheado en las versiones 2.95.12 y 3.131.0. Una solución alternativa para este problema implica configurar AUTH_<PROVIDER>_CHECK.

Information

Published : 2025-11-21 22:16

Updated : 2026-10-19 13:10

NVD link : CVE-2025-65107

Mitre link : CVE-2025-65107

CVE.ORG link : CVE-2025-65107

JSON object : View

Products Affected

langfuse

langfuse

CWE

CWE-285

Improper Authorization

CWE-352

Cross-Site Request Forgery (CSRF)

{"id": "CVE-2025-65107", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-65107", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-24T17:16:30.785561Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "langfuse", "product": "langfuse", "versions": [{"status": "affected", "version": ">= 2.95.0, < 2.95.12"}, {"status": "affected", "version": ">= 3.17.0, < 3.131.0"}]}]}], "published": "2025-11-21T22:16:33.127", "references": [{"url": "https://github.com/langfuse/langfuse/security/advisories/GHSA-w9pw-c549-5m6w", "tags": ["Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-285"}, {"lang": "en", "value": "CWE-352"}]}], "descriptions": [{"lang": "en", "value": "Langfuse is an open source large language model engineering platform. In versions from 2.95.0 to before 2.95.12 and from 3.17.0 to before 3.131.0, in SSO provider configurations without an explicit AUTH_<PROVIDER>_CHECK setting, a potential account takeover may happen if an authenticated user is made to call a specifically crafted URL via a CSRF or phishing attack. This issue has been patched in versions 2.95.12 and 3.131.0. A workaround for this issue involves setting AUTH_<PROVIDER>_CHECK."}, {"lang": "es", "value": "Langfuse es una plataforma de ingenier\u00eda de modelos de lenguaje grandes de c\u00f3digo abierto. En las versiones desde la 2.95.0 hasta la 2.95.12 y desde la 3.17.0 hasta la 3.131.0, en configuraciones de proveedor de SSO sin una configuraci\u00f3n expl\u00edcita de AUTH_<PROVIDER>_CHECK, podr\u00eda ocurrir una posible toma de control de cuenta si se obliga a un usuario autenticado a llamar a una URL espec\u00edficamente dise\u00f1ada mediante un ataque de CSRF o phishing. Este problema ha sido parcheado en las versiones 2.95.12 y 3.131.0. Una soluci\u00f3n alternativa para este problema implica configurar AUTH_<PROVIDER>_CHECK."}], "lastModified": "2026-10-19T13:10:00.110", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:langfuse:langfuse:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EE6B4DE7-2440-4B1D-A0F2-589B93CBDA39", "versionEndExcluding": "2.95.12", "versionStartIncluding": "2.95.0"}, {"criteria": "cpe:2.3:a:langfuse:langfuse:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FD1B1F82-761E-4FF8-A66E-0CAEA7EB39E6", "versionEndExcluding": "3.131.0", "versionStartIncluding": "3.17.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}