Improper authentication in IBM Langflow OSS (CVE-2026-9103)

CVE-2026-9103 is an improper authentication vulnerability in IBM Langflow OSS affecting the /api/v1/login/auto_login endpoint, which issues 365-day superuser bearer tokens without requiring credentials when the AUTO_LOGIN configuration is enabled (enabled by default). An unauthenticated, network-reachable attacker can obtain full administrative access; permissive CORS settings that allow wildcard origins with credentials further enable drive-by token theft from arbitrary websites. The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical). Affected versions: - 1.0.0-1.10.0 We recommend updating to: 1.10.1. CVSS 9.8 · our assessment: act_now Vendor advisory: https://www.ibm.com/support/pages/node/7278926 Details: https://vuln.today/cve/CVE-2026-9103