CVE-2026-55423

Published: Jun 23, 2026Modified: Jun 24, 2026

6.1

Vector

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Exploitability: 0.9 / Impact: 5.2

Source: security-advisories@github.com (Secondary)

Description

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.7.0, the logout button does not clear the session. The previous user stays logged in unless another user explicitly logs in. This vulnerability is fixed in 1.7.0.

Affected (1)

Products: Langflow: Langflow

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Langflow Langflow	Before 1.7.0

Related CWEs

Insufficient Session Expiration

According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

References (3)

https://github.com/langflow-ai/langflow/pull/10527

Source: security-advisories@github.com

Issue TrackingPatch

https://github.com/langflow-ai/langflow/pull/10528

Source: security-advisories@github.com

Issue TrackingExploit

https://github.com/langflow-ai/langflow/security/advisories/GHSA-7hw8-6q6r-4276

Source: security-advisories@github.com

Vendor AdvisoryExploitPatch

Timeline

No history available yet.