Skip to content
AI Sec Watch
MediumVulnerability

GHSA-7hw8-6q6r-4276: Langflow: Logout button does not clear session

Source
GitHub Advisory(opens in a new tab)
Identifiers
CVE-2026-55423GHSA-7hw8-6q6r-4276
Published
Record updated
View JSON
Affected
  • langflow < 1.7.0
Fixed in
1.7.1
  • released December 19, 2025, 182 days before disclosure
Known exploitation
Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
EPSS
0.2%

Summary

The logout button in Langflow does not clear the session, so the previous user remains logged in until someone else signs in. The /logout endpoint deleted the authentication cookies without matching their original httponly, samesite, secure and domain parameters, so the browser kept them, and the frontend did not clear the auth cookies. Users on shared computers may falsely believe they have ended their session.

Mitigation

Fixed in 1.7.0 (PRs #10527 and #10528). The logout endpoint now deletes the auth cookies using the same parameters they were created with, and the frontend clears the auth cookies on logout. Upgrade to 1.7.0 or later.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.