CVE-2025-65107

Executive Summary

CVE-2025-65107 is a medium-severity (CVSS 6.5) Cross-Site Request Forgery (CSRF) vulnerability in Langfuse, an open-source LLM engineering platform. The flaw affects SSO provider configurations where the AUTH_<PROVIDER>_CHECK setting is not explicitly defined. An attacker can craft a malicious URL that, when visited by an authenticated user (via CSRF or phishing), triggers an account takeover. The vulnerability is patched in versions 2.95.12 and 3.131.0, with a workaround of setting the AUTH_<PROVIDER>_CHECK environment variable.

Supply Chain & Package Security

Langfuse is distributed as a Python package (PyPI) and a Docker image. Users should verify the integrity of their installation and ensure they are not running a vulnerable version. The supply chain risk is moderate, as the vulnerability requires user interaction (clicking a link) and is not remotely exploitable without authentication.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The attack is carried out over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – The attacker does not need prior authentication.
• User Interaction (UI): Required (R) – The victim must click a crafted link.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): High (H) – Full account takeover leads to data exposure.
• Integrity (I): High (H) – Attacker can modify user data and settings.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. Exploitation requires user interaction, but the impact is severe (account takeover). The EPSS score of 0.0% suggests low active exploitation in the wild, but this may change as details become public.

Deep Dive & Mechanics

The vulnerability lies in Langfuse’s SSO (Single Sign-On) authentication flow. When an SSO provider (e.g., Google, GitHub, Okta) is configured without an explicit AUTH_<PROVIDER>_CHECK setting, the platform does not validate the origin or state parameter of the authentication callback. This allows an attacker to craft a URL that mimics a legitimate SSO callback, but with a malicious redirect or token manipulation.

Attack Flow:

1. The attacker identifies a Langfuse instance with SSO enabled and no AUTH_<PROVIDER>_CHECK set.
2. The attacker crafts a URL that points to the Langfuse SSO callback endpoint, but with a modified state or redirect_uri parameter.
3. The attacker sends this URL to an authenticated user via phishing email, social media, or a CSRF attack on another site.
4. The victim, while logged into Langfuse, clicks the link.
5. The Langfuse server processes the callback without verifying the origin, and the attacker’s session is linked to the victim’s account, effectively taking over the account.

Root Cause: Missing CSRF protection in the SSO callback handler. The AUTH_<PROVIDER>_CHECK setting, when enabled, validates the state parameter against a stored nonce, preventing this attack.

Vulnerable vs. Patched Code

Vulnerable Code (simplified):

# sso_callback.py (vulnerable)
@app.route('/auth/<provider>/callback')
def sso_callback(provider):
    code = request.args.get('code')
    state = request.args.get('state')
    # No check on state or origin
    token = exchange_code_for_token(provider, code)
    user = get_or_create_user(token)
    login_user(user)
    return redirect('/dashboard')

Patched Code (simplified):

# sso_callback.py (patched)
@app.route('/auth/<provider>/callback')
def sso_callback(provider):
    code = request.args.get('code')
    state = request.args.get('state')
    # Validate state against stored nonce
    if not validate_state(provider, state):
        abort(403)
    token = exchange_code_for_token(provider, code)
    user = get_or_create_user(token)
    login_user(user)
    return redirect('/dashboard')

The patch adds a call to validate_state(), which checks the state parameter against a cryptographically random nonce stored in the user’s session. This prevents CSRF attacks.

Exploitation & Lab Setup

Red Team (Attacker)

Lab Setup:

1. Deploy a vulnerable Langfuse instance (version 2.95.0) with SSO configured (e.g., Google OAuth) and no AUTH_GOOGLE_CHECK set.
2. Create a user account and obtain a valid session cookie.
3. Craft the exploit URL:

   https://victim-langfuse.com/auth/google/callback?code=ATTACKER_CODE&state=ATTACKER_STATE
   

   The attacker must have their own OAuth code and state from a separate authentication attempt.
4. Send the URL to the victim via a phishing email or embed it in a malicious page.
5. When the victim clicks the link while logged in, the attacker’s session is linked to the victim’s account.

Exploit Code (Python):

import requests

# Victim's Langfuse instance
target = "https://victim-langfuse.com"
# Attacker's OAuth code (obtained by initiating SSO with attacker's account)
attacker_code = "4/0AX4Xf..."
attacker_state = "random_state_123"

# Craft malicious callback URL
exploit_url = f"{target}/auth/google/callback?code={attacker_code}&state={attacker_state}"

# Send to victim (simulated)
print(f"Send this link to the victim: {exploit_url}")

Blue Team (Defender)

Detection:

• Monitor for unusual SSO callback requests, especially those with mismatched state parameters.
• Look for multiple failed SSO attempts from the same IP.
• Alert on any SSO callback that does not have a corresponding state nonce in the session.

Hunting:

• Search logs for auth/*/callback endpoints with code and state parameters.
• Correlate with session creation events to detect account takeover.

Indicators of Compromise (IOCs)

• Network: HTTP requests to /auth/<provider>/callback with code and state parameters from unexpected IPs.
• Logs: Multiple SSO callback requests without prior state generation.
• User Behavior: Sudden changes in user settings or permissions after an SSO callback.
• File System: No specific file IOCs; this is a logic flaw.

Detection Engineering

YARA Rule

rule CVE_2025_65107_Langfuse_SSO_CSRF {
    meta:
        description = "Detects vulnerable Langfuse SSO callback handling"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-65107"
    strings:
        $sso_callback = "/auth/" nocase
        $callback = "/callback" nocase
        $code_param = "code=" nocase
        $state_param = "state=" nocase
    condition:
        all of them
}

Sigma Rule

title: Langfuse SSO CSRF Exploitation Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects potential exploitation of CVE-2025-65107 via SSO callback requests
author: Valters IT
logsource:
    category: webserver
    product: langfuse
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - '/auth/'
            - '/callback'
            - 'code='
            - 'state='
    condition: selection
falsepositives:
    - Legitimate SSO logins
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-65107 Langfuse SSO CSRF Attempt"; flow:to_server; content:"/auth/"; http_uri; content:"/callback"; http_uri; content:"code="; http_uri; content:"state="; http_uri; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Set the AUTH_<PROVIDER>_CHECK environment variable to true for all configured SSO providers. This enables state validation.
2. Upgrade: Update Langfuse to version 2.95.12 or 3.131.0 (or later).
3. Network: Implement Web Application Firewall (WAF) rules to block suspicious SSO callback requests.
4. User Education: Train users to recognize phishing attempts and not click on suspicious links.
5. Monitoring: Enable logging for all SSO authentication events and alert on anomalies.

Valters IT
Securing the digital frontier, one CVE at a time.