CVE-2025-61163

Received Received - Intake

Excessively Permissive Cross-Domain Policy in Cohere North AI

Publication date: 2026-08-26

Last updated on: 2026-08-26

Assigner: MITRE

Description

Cohere North AI v1.1.5 was discovered to contain excessively permissive cross-domain policy with untrusted domains. This occurs via the server failing to validate the Origin header of incoming connection requests.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-26

Last Modified

2026-08-26

Generated

2026-08-27

AI Q&A

2026-08-27

EPSS Evaluated

N/A

NVD

CVE-2025-61163

Affected Vendors & Products

Vendor	Product	Version / Range
cohere	north_ai	1.1.5

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

Cohere North AI v1.1.5 has a vulnerability where it allows cross-domain connections without properly checking the Origin header of incoming requests. This means untrusted domains could potentially interact with the server, posing a security risk.

Impact Analysis

This vulnerability could allow unauthorized access or data exposure if an attacker exploits the overly permissive cross-domain policy. It may lead to sensitive information being shared with untrusted domains.

Compliance Impact

This vulnerability could violate data protection regulations like GDPR or HIPAA by enabling unauthorized data sharing with untrusted domains. Compliance may be compromised due to insufficient origin validation.

Mitigation Strategies

Immediately update Cohere North AI to the latest version that addresses the cross-domain policy validation issue. Review server configurations to ensure the Origin header is properly validated for all incoming requests. Restrict cross-domain access to trusted domains only.

Hi! I’m here to help you understand CVE-2025-61163. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70