CVE-2025-34291: HIGH (CVSS 8.8), Actively Exploited (CISA KEV)

HIGH (CVSS 8.8), Actively Exploited (CISA KEV), EPSS 78.9%. Langflow versions up to and including 1.6.9 contain a chained vulnerability that enables account takeover and remote code execution. An overly permissive CORS configuration (allow_origins='*' with allow_credentials=True) combined with a refresh token cookie configured as SameSite=None allows a malic