GHSA-4FH9-H7WG-Q85M vulnerabilities

Vulnerabilities for packages: langfuse, librechat, keycloak, langfuse-fips, drupal...

CVE-2025-66400 vulnerabilities

Vulnerabilities for packages: langfuse, librechat, keycloak, langfuse-fips, drupal...

EUVD-2025-26361

A security flaw has been discovered in Langfuse up to 3.88.0. Affected by this vulnerability is the function promptChangeEventSourcing of the file web/src/features/prompts/server/routers/promptRouter.ts of the component Webhook Handler. Performing manipulation results in server-side request...

GHSA-6465-JGVQ-JHGP vulnerabilities

Vulnerabilities for packages: langfuse...

CVE-2025-65944 vulnerabilities

Vulnerabilities for packages: langfuse...

CVE-2025-13466 vulnerabilities

Vulnerabilities for packages: saf, tileserver-gl, code-server...

GHSA-WQCH-XFXH-VRR4 vulnerabilities

Vulnerabilities for packages: saf, tileserver-gl, code-server...

GHSA-6465-JGVQ-JHGP vulnerabilities

Vulnerabilities for packages: langfuse...

CVE-2025-65944 vulnerabilities

Vulnerabilities for packages: langfuse...

CVE-2025-13466 vulnerabilities

Vulnerabilities for packages: opensearch-dashboards, code-server, saf, redisinsight, librechat, kibana, tileserver-gl, tileserver-gl-fips, opensearch-dashboards-fips...

GHSA-WQCH-XFXH-VRR4 vulnerabilities

Vulnerabilities for packages: opensearch-dashboards, code-server, saf, redisinsight, librechat, kibana, tileserver-gl, tileserver-gl-fips, opensearch-dashboards-fips...

CVE-2025-65107

Langfuse is an open source large language model engineering platform. In versions from 2.95.0 to before 2.95.12 and from 3.17.0 to before 3.131.0, in SSO provider configurations without an explicit AUTHCHECK setting, a potential account takeover may happen if an authenticated user is made to call...

CVE-2025-65107

Langfuse is an open source large language model engineering platform. In versions from 2.95.0 to before 2.95.12 and from 3.17.0 to before 3.131.0, in SSO provider configurations without an explicit AUTHCHECK setting, a potential account takeover may happen if an authenticated user is made to call...

CVE-2025-65107

CVE-2025-65107 affects Langfuse SSO configuration: versions 2.95.0–2.95.11 and 3.17.0–3.130.0 are vulnerable when an explicit AUTH_CHECK is not configured. Affected flow allows potential account takeover if an authenticated user is directed to a crafted URL via CSRF or phishing. Mitigations are p...

CVE-2025-65107 Langfuse SSO Account Takeover via CSRF or phishing attack

Langfuse is an open source large language model engineering platform. In versions from 2.95.0 to before 2.95.12 and from 3.17.0 to before 3.131.0, in SSO provider configurations without an explicit AUTHCHECK setting, a potential account takeover may happen if an authenticated user is made to call...

CVE-2025-65107 Langfuse SSO Account Takeover via CSRF or phishing attack

Langfuse is an open source large language model engineering platform. In versions from 2.95.0 to before 2.95.12 and from 3.17.0 to before 3.131.0, in SSO provider configurations without an explicit AUTHCHECK setting, a potential account takeover may happen if an authenticated user is made to call...

CVE-2025-65107 Langfuse SSO Account Takeover via CSRF or phishing attack

Langfuse is an open source large language model engineering platform. In versions from 2.95.0 to before 2.95.12 and from 3.17.0 to before 3.131.0, in SSO provider configurations without an explicit AUTHCHECK setting, a potential account takeover may happen if an authenticated user is made to call...

EUVD-2025-198512

Langfuse is an open source large language model engineering platform. In versions from 2.95.0 to before 2.95.12 and from 3.17.0 to before 3.131.0, in SSO provider configurations without an explicit AUTHCHECK setting, a potential account takeover may happen if an authenticated user is made to call...

CVE-2025-65107: Cross-Site Request Forgery (CSRF)

Langfuse is an open source large language model engineering platform. In versions from 2.95.0 to before 2.95.12 and from 3.17.0 to before 3.131.0, in SSO provider configurations without an explicit AUTH CHECK setting, a potential account takeover may happen if an authenticated user is made to cal...

langfuse 跨站请求伪造漏洞

langfuse is a large language model engineering platform open-sourced by Langfuse. A cross-site request forgery vulnerability exists in langfuse version 2.95.0 up to and including version 2.95.12 and version 3.17.0 up to and including version 3.131.0, which stems from a misconfiguration of SSO and...