Dify CVE-2025-63386

Exploitation targets the /console/api/setup endpoint, which reflects any Origin header and returns Access-Control-Allow-Credentials: true, allowing an arbitrary external site to issue credentialed cross-origin requests. Realistic exploitation requires a victim operator's browser to visit an attacker-controlled page (user interaction), and the exposed data is limited to first-time bootstrap/setup status. Per the vendor, the endpoint is unauthenticated by design only in SELF_HOSTED deployment mode and is protected by one-time setup guards and init-password validation, so the meaningful window is the pre-setup bootstrap phase; after initial setup completes, the one-time guards sharply limit any initialization abuse. These factors substantially reduce real-world risk below the raw 9.1 score.

The input lists a CVSS 3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), which rates this as critical with full confidentiality and integrity impact over the network with no privileges or user interaction. That rating is almost certainly inflated for a CWE-346 CORS misconfiguration: a reflected-origin + Access-Control-Allow-Credentials flaw is only exploitable when a victim's browser is lured to an attacker page, which in practice requires user interaction (not UI:N as scored), and the affected /console/api/setup endpoint exposes only first-time bootstrap/setup-status data rather than high-value secrets - so C:H/I:H overstates the real impact. Critically, the supplier formally DISPUTES this CVE: the referenced pull request (langgenius/dify#32224) does not patch the behavior but instead adds docstrings documenting that the endpoint is unauthenticated by design for bootstrap, gated by SELF_HOSTED deployment mode, one-time setup guards, and init-password validation. No EPSS score and no CISA KEV entry are present in the input, so there is no signal of active or probable exploitation; the two linked GitHub gists from the reporter appear to be proof-of-concept/write-up material. Net assessment: this is a high-CVSS-but-low-real-risk, vendor-disputed issue, not an operational priority - the CVSS network/no-interaction framing conflicts with both the CORS attack model (requires victim browser interaction) and the limited bootstrap-only data exposed; verify impact against the vendor's disputed position before acting.

An attacker hosts a malicious web page and lures a Dify operator (during or shortly after first-time bootstrap) into visiting it; because the /console/api/setup endpoint reflects any Origin and allows credentials, the page issues a credentialed cross-origin request and reads the reflected setup-status response. Reporter-published gists appear to document the behavior as a proof of concept, but the data obtainable is limited to bootstrap/setup status and the vendor disputes that this constitutes a vulnerability.