External risk intelligence

Dify CORS Misconfiguration Allows Arbitrary Cross-Origin Requests

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2025-63386

The vulnerability exists in an API endpoint (/console/api/setup) within Dify, which is commonly deployed as a web application platform. APIs serving console or setup functions in web applications are frequently exposed to the internet or reachable via web-based management interfaces, making this a commonly internet-facing component in standard deployments.

Langgenius Dify

1.9.1

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A Cross-Origin Resource Sharing (CORS) misconfiguration vulnerability has been identified in Dify, a web application platform. This issue could allow external parties to make authenticated requests, potentially impacting data integrity and confidentiality. While the supplier indicates the configuration is intentional for bootstrapping, the implications for unauthorized access warrant review.

Allows unauthorized access to authenticated actions.
Matters for data security and access controls.
Confirm relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit a flawed Cross-Origin Resource Sharing (CORS) policy in the setup API endpoint of Dify. This misconfiguration allows any external website to send requests to this endpoint, even if the user is not authenticated. If the endpoint is reachable, an attacker could leverage this to perform actions on behalf of a user, potentially leading to unauthorized access or data manipulation.

Accessible via the network.
Triggered by making an API request.
Risk of unauthorized actions.

Live Threat

Current exploitation, exposure, and threat context

A CORS misconfiguration in the Dify `/console/api/setup` endpoint could allow any external website to make authenticated requests to the system when supported by the advisory. This could potentially expose sensitive information or allow unauthorized actions within the Dify console.

Authenticated system data.
Arbitrary external websites.
Unauthorized system access.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in Dify's setup API endpoint impacts application owners responsible for the Dify platform and potentially infrastructure or platform teams if Dify is managed as a shared service. The first practical step is to identify all Dify instances, determine their internet reachability, and confirm their business criticality to prioritize remediation efforts.

Identify Dify instances and business criticality.
Confirm external reachability and potential impact.
Plan remediation with application and platform owners.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Dify and how is it used?

Dify is an open-source Large Language Model (LLM) app development platform. Developers and teams use it to build, manage, and deploy AI-powered applications. It provides a centralized interface for orchestration, backend service management, and API access, allowing users to integrate LLMs into workflows without deep infrastructure overhead.

What does CWE-346 mean for CVE-2025-63386?

CWE-346 identifies an origin validation error in web security. In the context of CVE-2025-63386, it means the Dify software fails to properly verify the source of incoming requests. By trusting any website that tries to connect, the application inadvertently allows external scripts to interact with internal console functions as if they were a legitimate, trusted part of your browser.

How is this CORS vulnerability triggered?

The flaw is triggered when a user visits a malicious website while simultaneously having an active Dify console session. The browser sends requests from the external site to the vulnerable API endpoint. Critically, this does not require complex software exploitation; the bug is effectively triggered by the software's own permissive policy toward cross-origin traffic.

Is my Dify installation at risk?

According to Halo Surface Signal, this vulnerability is likely relevant to your environment because the affected API endpoint is part of the console management interface. Because Dify is frequently deployed as an internet-facing platform to allow remote access for AI application management, this endpoint is often reachable by external networks.

What steps should I take if I run Dify?

Prioritize identifying all active Dify instances within your infrastructure to assess their reachability. Since the issue centers on an API endpoint, verify if your current deployment exposes this console interface to public networks. Engage your application teams to review business criticality and evaluate if limiting network access is appropriate for your specific setup.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.