External risk intelligence

Dify CORS Misconfiguration Allows Unauthenticated Cross-Origin Requests

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2025-63388

Dify is a platform designed as an LLM application development framework that typically exposes web-based interfaces and APIs for management and integration. CORS misconfigurations on such endpoints are commonly reachable via the public internet when the application is deployed to provide external services, making this surface likely to be exposed in standard operational environments.

Langgenius Dify

1.9.1

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical security vulnerability in Dify, a platform for developing AI applications. The issue involves a misconfiguration that could allow unauthorized access to system features from external websites, potentially impacting data and operations. The primary concern is to confirm if our environment is affected and to what extent.

Flaw allows outside sites to access system features.
Potential for unauthorized access to sensitive data.
Confirm relevance and potential exposure in our systems.

Attack Path

How an attacker could exploit the issue

An attacker can leverage a CORS misconfiguration in the Dify system features endpoint to bypass access controls. This vulnerability allows any external website to send requests to the Dify API, even if the user is unauthenticated. By exploiting this, an attacker could potentially access sensitive system information or trigger unintended actions. The supplier disputes this, stating that sending requests with credentials does not provide additional access compared to unauthenticated requests.

No authentication required.
Accesses system features endpoint.
Exposes sensitive information.

Live Threat

Current exploitation, exposure, and threat context

A Cross-Origin Resource Sharing (CORS) misconfiguration could allow any external website to make requests to the Dify console API with credentials, when supported by the advisory.

System authentication credentials.
Via overly permissive CORS policy.
Unauthorized actions could occur.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in Dify's `/console/api/system-features` endpoint likely impacts platform or application teams responsible for the Dify deployment. The first step is to identify all instances of Dify, confirm their reachability and business criticality, and then assign ownership for remediation planning.

Platform/Application teams own the issue.
Verify Dify instances and their exposure.
Plan remediation based on assessed risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Dify?

Dify is an open-source development platform used to build and manage Large Language Model (LLM) applications. It provides web-based interfaces and APIs that allow teams to create AI workflows, integrate models, and manage system features through a centralized dashboard.

What does CVE-2025-63388 mean?

This CVE identifies a Cross-Origin Resource Sharing (CORS) misconfiguration, classified as CWE-346. In simple terms, the software fails to properly restrict which websites can interact with its API. Because the policy is overly permissive, it allows external domains to make requests to the system as if they were a trusted part of your browser session.

How does an attacker trigger this vulnerability?

An attacker triggers this by inducing a user's browser to send cross-origin requests to the affected API endpoint. Crucially, this does not require complex local access; the vulnerability is triggered by simply visiting a malicious or compromised website while logged into the Dify console. Requests made without active session credentials still interact with the endpoint, as the misconfiguration broadly reflects origin headers.

Is my Dify instance at risk?

According to Halo Surface Signal, this vulnerability is likely relevant if your Dify instance is accessible via the public internet. Because the platform is designed to provide external services and API integrations, these web-based interfaces are often reachable from outside networks, increasing the likelihood that they can be targeted by unauthorized cross-origin requests.

What should I do if I run Dify?

First, locate all running instances of Dify within your environment to confirm which ones are reachable from the internet. Once mapped, assign an owner to each instance to evaluate its business criticality and prepare a remediation plan. Coordinate with your platform or application teams to monitor for updates or configuration guidance from the vendor that addresses this API access control issue.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.