A Cross-Origin Resource Sharing (CORS) misconfiguration vulnerability exists in Dify v1.9.1 in the /console/api/setup endpoint. The endpoint implements an insecure CORS policy that reflects any Origin header and enables Access-Control-Allow-Credentials: true, permitting arbitrary external domains to make authenticated requests.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Dify | Langgenius | 1.9.1 (including) | 1.9.1 (including) |