Iann0036

**Name of the Vulnerable Software and Affected Versions** Langflow versions prior to 1.7.0 **Description** The logout button fails to clear the user session, allowing a previous user to remain logged in unless another user explicitly authenticates. This occurs because the '/logout' endpoint deletes authentication cookies without matching the original `httponly`, `samesite`, `secure`, and `domain` parameters, causing the browser to retain them. Additionally, the frontend does not clear the authentication cookies upon logout. Specifically, the `access token lf` remains in both Local Storage and Cookies, and the `refresh token lf` remains in Cookies. This can lead to unauthorized access on shared computers where users believe they have terminated their session. **Recommendations** Update to version 1.7.0 or later.