{"id":"CVE-2026-55423","aliases":["GHSA-7hw8-6q6r-4276","PYSEC-2026-222"],"title":"Langflow: Logout button does not clear session","summary":"Langflow: Logout button does not clear session","severity":"medium","cvss":6.1,"cvssVector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","vendor":"langflow","product":"langflow","ecosystem":"pip","affected":["langflow < 1.7.0"],"patched":["langflow 1.7.0"],"published":"2026-06-19","updated":"2026-09-24","sourceUpdated":"2026-09-24T15:00:04.766539580Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-7hw8-6q6r-4276","references":[{"url":"https://github.com/langflow-ai/langflow/security/advisories/GHSA-7hw8-6q6r-4276"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55423"},{"url":"https://github.com/langflow-ai/langflow/pull/10527"},{"url":"https://github.com/langflow-ai/langflow/pull/10528"},{"url":"https://github.com/langflow-ai/langflow"},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/langflow/PYSEC-2026-222.yaml"},{"url":"https://github.com/advisories/GHSA-7hw8-6q6r-4276"}],"tags":["osv","pip","ghsa"],"epss":0.00222,"epssPercentile":0.12636,"cwe":["CWE-613"],"ingestedAt":"2026-06-22T13:35:24.304Z","slug":"CVE-2026-55423","body":"## Overview\n\n### Summary\nThe logout button does not clear the session. The previous user stays logged in unless another user explicitly logs in.\n\n### Details\nNot in auto login mode. Hosted on localhost. `access_token_lf` remains present in both Local Storage and Cookies. `refresh_token_lf` remains present in Cookies.\n\n**Root cause:** the `/logout` endpoint deleted the authentication cookies without matching the original `httponly`/`samesite`/`secure`/`domain` parameters, so the browser kept them; additionally the frontend did not clear the auth cookies on logout.\n\n```\nLANGFLOW_AUTO_LOGIN: \"False\"\nLANGFLOW_SUPERUSER: <set>\nLANGFLOW_SUPERUSER_PASSWORD: <set>\nLANGFLOW_SECRET_KEY: <set>\nLANGFLOW_NEW_USER_IS_ACTIVE: \"False\"\nLANGFLOW_ENABLE_SUPERUSER_CLI: \"False\"\n```\n\n### PoC\nClick Logout. Hit refresh to return to previous screen.\n\n### Impact\nUsers on shared computers may falsely believe they have terminated their session.\n\n### Patches\nFixed in **1.7.0** (PRs #10527 and #10528). The logout endpoint now deletes the auth cookies using the same parameters they were created with, and the frontend clears the auth cookies on logout. Upgrade to **1.7.0 or later**.\n\n## Affected packages\n\n- `langflow < 1.7.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `langflow 1.7.0`","depth":"sunlit","depthScore":34,"depthScoreParts":{"impact":33.6,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}