What’s Vulnerable › Vulnerabilities

CVE-2025-9799: Langfuse Webhook promptRouter.ts promptChangeEventSourcing server-side request forgery

• Severity: medium (CVSS 5.0 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-09-01 · updated 2026-10-19
• Weakness: CWE-918

Description

A security flaw has been discovered in Langfuse up to 3.88.0. Affected by this vulnerability is the function promptChangeEventSourcing of the file web/src/features/prompts/server/routers/promptRouter.ts of the component Webhook Handler. Performing manipulation results in server-side request forgery. The attack may be initiated remotely. A high degree of complexity is needed for the attack. The exploitation appears to be difficult. The exploit has been released to the public and may be exploited.

Affected products

• langfuse: through 3.88.0

References

• https://github.com/langfuse/langfuse/issues/8522
• https://github.com/langfuse/langfuse/issues/8522#issue-3320549867
• https://vuldb.com/?ctiid.322114
• https://vuldb.com/?id.322114
• https://vuldb.com/?submit.641128

Get alerted when CVE-2025-9799 or the next vulnerability affects your stack