{"data":{"id":"0283ba9f-be31-458e-8bed-c595346e9d7a","title":"GHSA-7hw8-6q6r-4276: Langflow: Logout button does not clear session","summary":"The logout button in Langflow does not clear the session, so the previous user remains logged in until someone else signs in. The /logout endpoint deleted the authentication cookies without matching their original httponly, samesite, secure and domain parameters, so the browser kept them, and the frontend did not clear the auth cookies. Users on shared computers may falsely believe they have ended their session.","solution":"Fixed in 1.7.0 (PRs #10527 and #10528). The logout endpoint now deletes the auth cookies using the same parameters they were created with, and the frontend clears the auth cookies on logout. Upgrade to 1.7.0 or later.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-7hw8-6q6r-4276","publishedAt":"2026-06-19T21:17:01.000Z","cveId":"CVE-2026-55423","cweIds":null,"cvssScore":null,"cvssSeverity":"medium","severity":"medium","attackType":[],"issueType":"vulnerability","affectedPackages":["langflow@< 1.7.0 (fixed: 1.7.1)"],"affectedPackageNames":["langflow"],"affectedPackageRefs":["pypi:langflow"],"affectedVendors":[],"affectedVendorsRaw":["Langflow"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00222,"epssCheckedAt":"2026-11-04T18:09:12.971Z","kevDateAdded":null,"advisoryAliases":["GHSA-7hw8-6q6r-4276"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-06-19T21:17:01.000Z","fixReleasedAt":"2025-12-19T22:49:50.879Z","daysToFix":-182,"fixCheckedAt":"2026-10-29T21:34:09.270Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"langflow","fixedVersion":"1.7.1","matchedVersion":"1.7.1","fixReleasedAt":"2025-12-19T22:49:50.879Z","daysToFix":-182,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:34:09.125Z"}]}}