CVE-2025-9799 — Langfuse Webhook promptRouter.ts promptChangeEventSourcing server-side request forgery

Description (CNA)

A security flaw has been discovered in Langfuse up to 3.88.0. Affected by this vulnerability is the function promptChangeEventSourcing of the file web/src/features/prompts/server/routers/promptRouter.ts of the component Webhook Handler. Performing manipulation results in server-side request forgery. The attack may be initiated remotely. A high degree of complexity is needed for the attack. The exploitation appears to be difficult. The exploit has been released to the public and may be exploited.

Affected (CNA)

Vendor / product	Versions
n/a / Langfuse	affected 3.0; affected 3.1; affected 3.2; affected 3.3; affected 3.4; affected 3.5; affected 3.6; affected 3.7; affected 3.8; affected 3.9; affected 3.10; affected 3.11; affected 3.12; affected 3.13; affected 3.14; affected 3.15; affected 3.16; affected 3.17; affected 3.18; affected 3.19; affected 3.20; affected 3.21; affected 3.22; affected 3.23; affected 3.24; affected 3.25; affected 3.26; affected 3.27; affected 3.28; affected 3.29; affected 3.30; affected 3.31; affected 3.32; affected 3.33; affected 3.34; affected 3.35; affected 3.36; affected 3.37; affected 3.38; affected 3.39; affected 3.40; affected 3.41; affected 3.42; affected 3.43; affected 3.44; affected 3.45; affected 3.46; affected 3.47; affected 3.48; affected 3.49; affected 3.50; affected 3.51; affected 3.52; affected 3.53; affected 3.54; affected 3.55; affected 3.56; affected 3.57; affected 3.58; affected 3.59; affected 3.60; affected 3.61; affected 3.62; affected 3.63; affected 3.64; affected 3.65; affected 3.66; affected 3.67; affected 3.68; affected 3.69; affected 3.70; affected 3.71; affected 3.72; affected 3.73; affected 3.74; affected 3.75; affected 3.76; affected 3.77; affected 3.78; affected 3.79; affected 3.80; affected 3.81; affected 3.82; affected 3.83; affected 3.84; affected 3.85; affected 3.86; affected 3.87; affected 3.88.0

Vendor / product

Versions

n/a / Langfuse

affected 3.0; affected 3.1; affected 3.2; affected 3.3; affected 3.4; affected 3.5; affected 3.6; affected 3.7; affected 3.8; affected 3.9; affected 3.10; affected 3.11; affected 3.12; affected 3.13; affected 3.14; affected 3.15; affected 3.16; affected 3.17; affected 3.18; affected 3.19; affected 3.20; affected 3.21; affected 3.22; affected 3.23; affected 3.24; affected 3.25; affected 3.26; affected 3.27; affected 3.28; affected 3.29; affected 3.30; affected 3.31; affected 3.32; affected 3.33; affected 3.34; affected 3.35; affected 3.36; affected 3.37; affected 3.38; affected 3.39; affected 3.40; affected 3.41; affected 3.42; affected 3.43; affected 3.44; affected 3.45; affected 3.46; affected 3.47; affected 3.48; affected 3.49; affected 3.50; affected 3.51; affected 3.52; affected 3.53; affected 3.54; affected 3.55; affected 3.56; affected 3.57; affected 3.58; affected 3.59; affected 3.60; affected 3.61; affected 3.62; affected 3.63; affected 3.64; affected 3.65; affected 3.66; affected 3.67; affected 3.68; affected 3.69; affected 3.70; affected 3.71; affected 3.72; affected 3.73; affected 3.74; affected 3.75; affected 3.76; affected 3.77; affected 3.78; affected 3.79; affected 3.80; affected 3.81; affected 3.82; affected 3.83; affected 3.84; affected 3.85; affected 3.86; affected 3.87; affected 3.88.0

CWE

CWE-918

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.