CVE-2025-65107

MediumCVSS 6.5

Published: 21/11/2025(UTC)Updated: 19/10/2026(UTC)Translated: 19/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.16%

4th percentile - higher than 4% of all known CVEs

Summary

Langfuse versions 2.95.0 to before 2.95.12 and 3.17.0 to before 3.131.0 have a vulnerability in SSO provider configurations without an explicit AUTH_<PROVIDER>_CHECK setting, potentially allowing account takeover via CSRF or phishing.

Risk Assessment

An authenticated user could be tricked into calling a crafted URL, leading to account takeover and access to platform data.

Recommendation

Update Langfuse to version 2.95.12 or 3.131.0. As a workaround, explicitly set AUTH_<PROVIDER>_CHECK.

Other vulnerabilities in Langfuse

CVE-2025-9799Medium
Langfuse up to version 3.88.0 has a server-side request forgery (SSRF) vulnerability in the promptChangeEventSourcing function in web/src/features/prompts/server/routers/promptRouter.ts (Webhook Handler component). The attack may be initiated remotely but requires high complexity.

Original NVD description (English source)

Langfuse is an open source large language model engineering platform. In versions from 2.95.0 to before 2.95.12 and from 3.17.0 to before 3.131.0, in SSO provider configurations without an explicit AUTH_<PROVIDER>_CHECK setting, a potential account takeover may happen if an authenticated user is made to call a specifically crafted URL via a CSRF or phishing attack. This issue has been patched in versions 2.95.12 and 3.131.0. A workaround for this issue involves setting AUTH_<PROVIDER>_CHECK.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS