CVE-2026-55423: Langflow: Logout button does not clear session

The /logout endpoint in src/backend/base/langflow/api/v1/login.py deleted the auth cookies without the httponly, samesite, secure and domain values they were set with. Browsers only delete a cookie when those attributes match, so the cookies survived. The frontend also did not clear them. The PR names three cookies: refresh_token_lf, access_token_lf and apikey_tkn_lflw. The reporter saw access_token_lf stay in both Local Storage and Cookies, and refresh_token_lf stay in Cookies. Pressing refresh after Logout returned to the previous screen.

The reporter tested with auto-login off (LANGFLOW_AUTO_LOGIN false) and a set superuser, secret key and password, so authentication was on. The attacker needs physical access to the same browser profile, which matches the vector (AV:P). They then get everything the previous user could do in Langflow: flows, stored credentials and API keys the user can see, and the ability to run flows. Users of shared or kiosk machines who believe they signed out are the ones at risk. Remote attackers gain nothing from this alone.

Langflow versions before 1.7.0 with authentication on. Auto-login mode was not the tested setup. Check the installed version:

pip show langflow

If you run the Docker image, check the image tag.

Upgrade to Langflow 1.7.0 or later.

pip install --upgrade "langflow>=1.7.0"

Pull requests 10527 and 10528 make the logout endpoint delete the cookies with the same parameters used to create them, and make the frontend clear the auth cookies on logout. The advisory gives no workaround. Until you upgrade, users on shared machines should clear cookies and Local Storage for the Langflow site by hand, or close the browser profile after signing out.

On a shared machine, open the browser developer tools after clicking Logout and check Application > Cookies and Local Storage for access_token_lf, refresh_token_lf and apikey_tkn_lflw. If they are still present, the session is not ended. On the server, look for requests from the same user session after a logout time, or from a different person using the same browser. There is no distinct server log line for this flaw.

Summary

The logout button does not clear the session. The previous user stays logged in unless another user explicitly logs in.

Details

Not in auto login mode. Hosted on localhost. access_token_lf remains present in both Local Storage and Cookies. refresh_token_lf remains present in Cookies.

Root cause: the /logout endpoint deleted the authentication cookies without matching the original httponly/samesite/secure/domain parameters, so the browser kept them; additionally the frontend did not clear the auth cookies on logout.

LANGFLOW_AUTO_LOGIN: "False"
LANGFLOW_SUPERUSER: <set>
LANGFLOW_SUPERUSER_PASSWORD: <set>
LANGFLOW_SECRET_KEY: <set>
LANGFLOW_NEW_USER_IS_ACTIVE: "False"
LANGFLOW_ENABLE_SUPERUSER_CLI: "False"

PoC

Click Logout. Hit refresh to return to previous screen.

Impact

Users on shared computers may falsely believe they have terminated their session.

Patches

Fixed in 1.7.0 (PRs #10527 and #10528). The logout endpoint now deletes the auth cookies using the same parameters they were created with, and the frontend clears the auth cookies on logout. Upgrade to 1.7.0 or later.