
Scanner: CVE-2025-34291 Langflow Origin Validation Error / CORS Misconfiguration — Python checker (CISA KEV)
Overly permissive CORS config combined with refresh token cookie config allows credential theft.
| Field | Value |
|---|---|
| CVE | CVE-2025-34291 |
| Severity | HIGH |
| Product | Langflow |
| CISA KEV | 2026-05-21 |
| Attack Type | Origin Validation / CORS |
| Auth Required | None |
| Status | Versions |
|---|---|
| ❌ Vulnerable | Langflow versions before 1.3.5 |
| ✅ Fixed | Fixed in Langflow 1.3.5+ |
# Clone
git clone https://github.com/ridhinva/CVE-2025-34291-Langflow-Scanner.git
cd CVE-2025-34291-Langflow-Scanner
# Install deps (if any)
pip install requests
python3 langflow_scanner.py example.com
python3 langflow_scanner.py https://192.168.1.1
echo "target1.com" > targets.txt
echo "target2.com" >> targets.txt
python3 langflow_scanner.py targets.txt
python3 langflow_scanner.py --info
The scanner checks for exposed endpoints associated with this vulnerability and reports potential targets for manual verification.
| Source | Link |
|---|---|
| CISA KEV | https://www.cisa.gov/known-exploited-vulnerabilities-catalog |
| NVD Entry | https://nvd.nist.gov/vuln/detail/CVE-2025-34291 |
For authorized security testing and educational purposes only. Unauthorized access is illegal.
@c_y_p_h3r — Bug bounty hunter & security researcher
| Vendor Advisory |
| https://security.paloaltonetworks.com/CVE202534291 |