CVE-2026-55423

Name of the Vulnerable Software and Affected Versions Langflow versions prior to 1.7.0

Description The logout button fails to clear the user session, allowing a previous user to remain logged in unless another user explicitly authenticates. This occurs because the '/logout' endpoint deletes authentication cookies without matching the original httponly, samesite, secure, and domain parameters, causing the browser to retain them. Additionally, the frontend does not clear the authentication cookies upon logout. Specifically, the access token lf remains in both Local Storage and Cookies, and the refresh token lf remains in Cookies. This can lead to unauthorized access on shared computers where users believe they have terminated their session.

Recommendations Update to version 1.7.0 or later.