{"id":"CVE-2026-55423","title":"Langflow: Logout button does not clear session","summary":"Langflow: Logout button does not clear session","severity":"medium","cvss":6.1,"cwe":["CWE-613"],"vendor":"langflow","product":"langflow","ecosystem":"pip","affected":["langflow < 1.7.0"],"patched":["langflow 1.7.1"],"published":"2026-06-19","updated":"2026-06-19","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-7hw8-6q6r-4276","references":[{"url":"https://github.com/langflow-ai/langflow/security/advisories/GHSA-7hw8-6q6r-4276"},{"url":"https://github.com/langflow-ai/langflow/pull/10527"},{"url":"https://github.com/langflow-ai/langflow/pull/10528"},{"url":"https://github.com/advisories/GHSA-7hw8-6q6r-4276"}],"tags":["ghsa","pip"],"epss":0.00222,"epssPercentile":0.12954,"ingestedAt":"2026-06-22T13:35:24.304Z","slug":"CVE-2026-55423","body":"## Overview\n\n### Summary\nThe logout button does not clear the session. The previous user stays logged in unless another user explicitly logs in.\n\n### Details\nNot in auto login mode. Hosted on localhost. `access_token_lf` remains present in both Local Storage and Cookies. `refresh_token_lf` remains present in Cookies.\n\n**Root cause:** the `/logout` endpoint deleted the authentication cookies without matching the original `httponly`/`samesite`/`secure`/`domain` parameters, so the browser kept them; additionally the frontend did not clear the auth cookies on logout.\n\n```\nLANGFLOW_AUTO_LOGIN: \"False\"\nLANGFLOW_SUPERUSER: <set>\nLANGFLOW_SUPERUSER_PASSWORD: <set>\nLANGFLOW_SECRET_KEY: <set>\nLANGFLOW_NEW_USER_IS_ACTIVE: \"False\"\nLANGFLOW_ENABLE_SUPERUSER_CLI: \"False\"\n```\n\n### PoC\nClick Logout. Hit refresh to return to previous screen.\n\n### Impact\nUsers on shared computers may falsely believe they have terminated their session.\n\n### Patches\nFixed in **1.7.0** (PRs #10527 and #10528). The logout endpoint now deletes the auth cookies using the same parameters they were created with, and the frontend clears the auth cookies on logout. Upgrade to **1.7.0 or later**.\n\n## Affected packages\n\n- `langflow < 1.7.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `langflow 1.7.1`","depth":"sunlit","depthScore":34,"depthScoreParts":{"impact":33.6,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}