CVE-2025-61163

Deferred Deferred - Pending Action

Excessively Permissive Cross-Domain Policy in Cohere North AI

Publication date: 2026-08-26

Last updated on: 2026-09-03

Assigner: MITRE

Description

Cohere North AI v1.1.5 was discovered to contain excessively permissive cross-domain policy with untrusted domains. This occurs via the server failing to validate the Origin header of incoming connection requests.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-26

Last Modified

2026-09-03

Generated

2026-09-16

AI Q&A

2026-08-27

EPSS Evaluated

2026-09-15

NVD

CVE-2025-61163

Affected Vendors & Products

Vendor	Product	Version / Range
cohere	north_ai	1.1.5

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-942	The product uses a web-client protection mechanism such as a Content Security Policy (CSP) or cross-domain policy file, but the policy includes untrusted domains with which the web client is allowed to communicate.

Attack-Flow Graph

Executive Summary

Cohere North AI v1.1.5 has a vulnerability where it allows cross-domain connections without properly checking the Origin header of incoming requests. This means untrusted domains could potentially interact with the server, posing a security risk.

Detection Guidance

To detect this vulnerability, monitor HTTP responses for overly permissive cross-domain policies. Check if the server responds with Access-Control-Allow-Origin set to wildcard (*) or untrusted domains. Use curl to inspect headers: curl -I http://target-domain.com. Look for misconfigured CORS policies allowing arbitrary origins.

Impact Analysis

This vulnerability could allow unauthorized access or data exposure if an attacker exploits the overly permissive cross-domain policy. It may lead to sensitive information being shared with untrusted domains.

Compliance Impact

This vulnerability could violate data protection regulations like GDPR or HIPAA by enabling unauthorized data sharing with untrusted domains. Compliance may be compromised due to insufficient origin validation.

Mitigation Strategies

Immediately update Cohere North AI to the latest version that addresses the cross-domain policy validation issue. Review server configurations to ensure the Origin header is properly validated for all incoming requests. Restrict cross-domain access to trusted domains only.

Hi! I’m here to help you understand CVE-2025-61163. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70