CVE-2026-9103

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.10.0

Description Improper authentication in the '/api/v1/login/auto login' endpoint allows remote attackers to gain unauthorized administrative access. When the AUTO LOGIN configuration is enabled, which is the default setting, the endpoint issues long-lived superuser bearer tokens without requiring authentication. Furthermore, permissive Cross-Origin Resource Sharing (CORS)—a mechanism that allows restricted resources on a web page to be requested from another domain—may expose these tokens to unintended origins.

Recommendations Disable the AUTO LOGIN configuration for versions 1.0.0 through 1.10.0 to prevent the issuance of unauthenticated superuser tokens.