CVE-2026-93680: Auto-login security control
An incomplete remediation of the Langflow auto-login security control lets a remote attacker bypass authentication, opening the door to the authenticated code execution flaws fixed in the same release.
Executive Summary & Technical Impact
An incomplete remediation of the Langflow auto-login security control lets a remote attacker bypass authentication, opening the door to the authenticated code execution flaws fixed in the same release.
Tracked under CVE-2026-93680 (CWE-287 (Improper Authentication)), this vulnerability affects Langflow OSS 1.0.0 through 1.12.8 and carries a severity score of 9.8 (CVSS 3.1, IBM) (CRITICAL). Engineering and security operations teams running Langflow OSS should prioritize upgrading to Langflow OSS 1.13.0.
Remediation & Patch Guidance
- Upgrade to Langflow OSS 1.13.0 or later.
- Disable auto-login and require authentication on every deployment.
- Review user accounts and flows created recently for signs of unauthorized access.
Frequently Asked Questions (CVE-2026-93680)
What versions are affected by CVE-2026-93680?
CVE-2026-93680 affects Langflow OSS 1.0.0 through 1.12.8 in Langflow OSS (Auto-login security control).
How do I patch or remediate CVE-2026-93680?
Upgrade affected deployments to Langflow OSS 1.13.0 and verify the remediation steps listed above.
What is the CVSS score of CVE-2026-93680?
CVE-2026-93680 is rated CRITICAL with a CVSS score of 9.8 (CVSS 3.1, IBM) (vector: Network; unauthenticated (AV:N/AC:L/PR:N/UI:N)).
Your AI Dev Tools Are the New Attack Surface: npm 'open' PowerShell Injection (CVE-2026-119025), Langflow RCE, and Broken Built-In Browsers
A malicious MCP server can run code on Windows the moment you connect, Langflow OSS ships 9.8-rated unauthenticated RCE fixes, and new EMBRACE research shows coding-assistant browsers reading local files.
Read full engineering post-mortem (6 min read) →