CISA adds Langflow Origin Validation Flaw to Known Exploited Vulnerabilities Catalog

CISA added CVE-2025-34291 — a Langflow origin validation/CORS flaw that, when combined with SameSite=None refresh cookies, enables authenticated cross-origin requests and theft of refresh tokens — to its Known Exploited Vulnerabilities catalog, warning of active exploitation and urging immediate remediation (patches, restrictive CORS, avoiding SameSite=None, CSRF protections, monitoring, or discontinuation).