Langfuse Prise de contrôle de compte SSO via attaque CSRF ou phishing

The primary impact of CVE-2025-65107 is unauthorized account takeover. An attacker can craft a malicious URL that, when visited by an authenticated user, triggers actions on their behalf without their knowledge or consent. This could involve modifying user settings, accessing sensitive data, or performing other actions as if they were the legitimate user. The vulnerability is particularly concerning because it leverages the user's existing authentication session, making it difficult to detect. Successful exploitation requires the user to interact with the malicious URL, typically through phishing or other social engineering techniques. The blast radius is limited to the individual user accounts affected, but the potential for widespread compromise exists if the attacker can target a large number of users.

Organizations utilizing Langfuse for LLM engineering, particularly those relying on Single Sign-On (SSO) integrations, are at risk. Deployment patterns that do not explicitly configure AUTH<PROVIDER>CHECK settings are especially vulnerable. Shared hosting environments where multiple users share the same Langfuse instance should be prioritized for patching.

• linux / server: Examine Langfuse configuration files for the presence of AUTH<PROVIDER>CHECK. Use grep to search for this setting in /etc/langfuse/config.yml or similar configuration locations.

grep -r AUTH_GOOGLE_CHECK /etc/langfuse/config.yml
grep -r AUTH_GITHUB_CHECK /etc/langfuse/config.yml

• generic web: Monitor access logs for unusual requests originating from unfamiliar IP addresses, especially those targeting SSO authentication endpoints. Look for patterns indicative of CSRF attempts. • wordpress / composer / npm: N/A - Langfuse is not a WordPress plugin or Node.js package.

1. 2025-11-21Disclosure

   disclosure

1. Réservé2025-11-17
2. Publiée2025-11-21
3. Modifiée2025-11-24
4. EPSS mis à jour2026-03-23

The primary mitigation for CVE-2025-65107 is to upgrade Langfuse to version 2.95.12 or 3.131.0, which contain the fix. If upgrading immediately is not feasible, a workaround involves setting the AUTH<PROVIDER>CHECK configuration option. This setting enforces stricter authentication checks and prevents the CSRF attack from succeeding. Review SSO provider configurations to ensure this setting is enabled. Implement robust user awareness training to educate users about the risks of phishing and malicious URLs. Consider implementing a Content Security Policy (CSP) to restrict the sources from which scripts can be executed, further mitigating the risk of CSRF attacks. After upgrading, confirm the fix by attempting to trigger a request via a crafted URL and verifying that it is blocked.