CVE-2025-9799

A security flaw has been discovered in Langfuse up to 3.88.0. Affected by this vulnerability is the function promptChangeEventSourcing of the file web/src/features/prompts/server/routers/promptRouter.ts of the component Webhook Handler. Performing manipulation results in server-side request forgery. The attack may be initiated remotely. A high degree of complexity is needed for the attack. The exploitation appears to be difficult. The exploit has been released to the public and may be exploited.

• CWE-918

• https://github.com/langfuse/langfuse/issues/8522Exploit, Issue Tracking
• https://github.com/langfuse/langfuse/issues/8522#issue-3320549867Exploit, Issue Tracking
• https://vuldb.com/?ctiid.322114Permissions Required, VDB Entry
• https://vuldb.com/?id.322114Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.641128Third Party Advisory, VDB Entry

Published

Sep 1, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-9793A vulnerability was detected in itsourcecode Apartment Manag…9.8
• CVE-2025-9794A flaw has been found in Campcodes Computer Sales and Invent…9.8
• CVE-2025-9795A vulnerability has been found in xujeff tianti 天梯 up to 2.3…5.4
• CVE-2025-9796A vulnerability was found in thinkgem JeeSite up to 5.12.1. …4.1
• CVE-2025-9797A vulnerability was determined in mrvautin expressCart up to…2.4
• CVE-2025-9798Improper Neutralization of Input During Web Page Generation …8.9
• CVE-2025-9800A weakness has been identified in SimStudioAI sim up to ed9b…6.1
• CVE-2025-9801A security vulnerability has been detected in SimStudioAI si…8.1
• CVE-2025-9802A vulnerability was detected in RemoteClinic 2.0. This vulne…5.1
• CVE-2025-9803lunary-ai/lunary version 1.9.34 is vulnerable to an account …8.8
• CVE-2025-9804An improper access control vulnerability exists in multiple …6.5
• CVE-2025-9805A vulnerability was found in SimStudioAI sim up to 51b1e97fa…7.5