Description
Langflow /api/v1/login 默认口令漏洞，是由于该应用存在默认账号密码langflow/langflow且未强制修改，攻击者可直接向/api/v1/login接口发送携带默认凭证的 POST 请求，无需授权即可登录后台获取管理员权限，进而控制整个系统，属于高危未授权访问漏洞。
Langflow /api/v1/login 默认口令漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://www.ddpoc.com/DVB-2026-10944.html
https://zhuanlan.zhihu.com/p/2036117482176500896
https://docs.langflow.org/api-keys-and-authentication
https://github.com/langflow-ai/langflow/security/advisories/GHSA-vwmf-pq79-vjvx
https://www.obsidiansecurity.com/blog/cve-2025-34291-critical-account-takeover-and-rce-vulnerability-in-the-langflow-ai-agent-workflow-platform