{"data":{"id":"60999fa6-fc1d-4ee7-bb6b-014f4662c0a0","title":"CVE-2026-9103: IBM Langflow OSS 1.0.0 through 1.10.0 could allow a remote attacker to gain unauthorized access due to improper…","summary":"IBM Langflow OSS versions 1.0.0 through 1.10.0 contain CVE-2026-9103, an improper authentication flaw in the /api/v1/login/auto_login endpoint. When AUTO_LOGIN is enabled, which is the default, the endpoint issues long-lived superuser bearer tokens without requiring authentication, which may let an unauthenticated network attacker gain full administrative access. Permissive CORS settings may also expose tokens to unintended origins.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-9103","publishedAt":"2026-07-17T19:17:19.277Z","cveId":"CVE-2026-9103","cweIds":["CWE-306"],"cvssScore":"9.8","cvssSeverity":"critical","severity":"critical","attackType":["jailbreak"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["IBM Langflow OSS"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"IBM Langflow OSS unauthorized access through /api/v1/login/auto_login endpoint","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","attackVector":"network","attackComplexity":"low","privilegesRequired":"none","userInteraction":"none","exploitMaturity":"unknown","epssScore":0.03208,"epssCheckedAt":"2026-11-13T00:12:56.798Z","kevDateAdded":null,"advisoryAliases":["GHSA-88m4-9v35-3pc9"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-11-09T18:10:04.717Z","patchAvailable":null,"disclosureDate":"2026-07-17T19:17:19.277Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":["CAPEC-115"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":["AML.T0054"],"fixes":[]}}