CVE-2025-56157

Default credentials in Dify thru 1.5.1. PostgreSQL username and password specified in the docker-compose.yaml file included in its source code. NOTE: the Supplier reports that the Docker configuration does not make PostgreSQL (on TCP port 5432) exposed by default in version 1.0.1 or later.

• CWE-798

• https://gist.github.com/Cristliu/216ddbadaf3258498c93d408683ecabdExploit, Mitigation, Third Party Advisory
• https://gist.github.com/Cristliu/298f51cbc72c45d91632cd0d65aa8161
• https://github.com/langgenius/difyProduct
• https://github.com/langgenius/dify/issues/15285
• https://github.com/langgenius/dify/pull/15286
• https://github.com/langgenius/dify/pull/15286.diff
• https://github.com/langgenius/dify/releases/tag/1.0.1
• https://gist.github.com/Cristliu/216ddbadaf3258498c93d408683ecabdExploit, Mitigation, Third Party Advisory

Published

Dec 18, 2025

Last Modified

Jul 5, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-56132LiquidFiles filetransfer server is vulnerable to a user enum…7.3
• CVE-2025-56139LinkedIn Mobile Application for Android version 4.1.1087.2 f…5.3
• CVE-2025-5614A vulnerability was found in PHPGurukul Online Fire Reportin…8.8
• CVE-2025-56146Indian Bank IndSMART Android App 3.8.1 is vulnerable to Miss…5.3
• CVE-2025-5615A vulnerability was found in PHPGurukul Online Fire Reportin…8.8
• CVE-2025-56154htmly v3.0.8 is vulnerable to Cross Site Scripting (XSS) in …6.1
• CVE-2025-5616A vulnerability was found in PHPGurukul Online Fire Reportin…8.8
• CVE-2025-56161YOSHOP 2.0 allows unauthenticated information disclosure via…7.5
• CVE-2025-56162YOSHOP 2.0 suffers from an unauthenticated SQL injection in …6.5
• CVE-2025-5617A vulnerability classified as critical has been found in PHP…9.8
• CVE-2025-5618A vulnerability classified as critical was found in PHPGuruk…9.8
• CVE-2025-5619A vulnerability, which was classified as critical, has been …9.8