CVE-2025-61163 in North AI
Summary
by MITRE • 08/26/2026
Cohere North AI v1.1.5 was discovered to contain excessively permissive cross-domain policy with untrusted domains. This occurs via the server failing to validate the Origin header of incoming connection requests.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/26/2026
The vulnerability identified in Cohere North AI version 1.1.5 represents a critical failure in implementing proper Cross-Origin Resource Sharing (CORS) policies, specifically classified under CWE-942 as Permissive Cross-domain Policy with Untrusted Domains. This flaw stems from the server's inability to adequately validate or restrict the Origin header present in incoming HTTP requests. In standard web application security architecture, the Origin header serves as a primary mechanism for browsers and clients to indicate the source of a request, allowing servers to enforce strict boundaries on which domains are permitted to access sensitive resources via cross-origin calls. By failing to perform this validation, the server effectively treats all origin headers as trusted or ignores them entirely, thereby granting unrestricted cross-domain access capabilities to any external entity that can craft appropriate HTTP requests.
From an operational perspective, this misconfiguration exposes the application to a range of client-side attacks, most notably Cross-Site Request Forgery (CSRF) and data exfiltration via malicious scripts. An attacker hosting a rogue website could embed JavaScript code designed to send authenticated requests to the Cohere North AI API endpoints without triggering browser security checks that would normally block such cross-origin interactions if proper CORS headers were correctly configured with specific allowed origins or preflight validations. This allows attackers to perform actions on behalf of authenticated users who have active sessions with the vulnerable service, potentially leading to unauthorized data retrieval, modification of user settings, or execution of administrative functions depending on the privileges associated with those accounts.
The technical impact is further compounded by the potential for information disclosure. If the API endpoints return sensitive internal data such as model weights, proprietary algorithms, customer usage patterns, or personally identifiable information in response to these unvalidated cross-origin requests, attackers can programmatically harvest this data from a victim's browser context where they are logged into the service. This scenario aligns with ATT&CK technique T1530, Data from Cloud Storage, and potentially T1078, Valid Accounts, as it leverages legitimate user credentials to access resources outside their intended scope of interaction. The lack of origin validation removes a fundamental layer of defense-in-depth that is essential for protecting single-page applications and API-driven services against malicious third-party sites.
Mitigation strategies must focus on implementing strict CORS policies at the web server or application framework level. Administrators should configure the Access-Control-Allow-Origin header to explicitly list only those domains that are authorized to interact with the service, rather than using wildcard values like asterisks which permit access from any origin. Additionally, it is crucial to ensure that credentials such as cookies and authorization headers are not included in cross-origin requests unless absolutely necessary and properly secured via appropriate flags. Implementing preflight request handling for non-simple methods can also add an extra layer of verification before state-changing operations are executed. Regular security audits and automated scanning tools should be employed to detect misconfigurations related to CORS, ensuring that the application adheres to industry best practices defined by OWASP regarding cross-origin resource sharing protections.