6.1

CVE-2026-55423

Exploit

Langflow: Logout button does not clear session

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.7.0, the logout button does not clear the session. The previous user stays logged in unless another user explicitly logs in. This vulnerability is fixed in 1.7.0.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Langflow ≫ Langflow Version < 1.7.0
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.15% 0.047
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
security-advisories@github.com 6.1 0.9 5.2
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CWE-613 Insufficient Session Expiration

According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

https://github.com/langflow-ai/langflow/security/advisories/GHSA-7hw8-6q6r-4276
Patch
Vendor Advisory
Exploit
https://github.com/langflow-ai/langflow/pull/10527
Patch
Issue Tracking
https://github.com/langflow-ai/langflow/pull/10528
Exploit
Issue Tracking