CVE-2025-61163

{
  "id": "CVE-2025-61163",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-26T19:16:44.290",
  "lastModified": "2026-10-26T21:10:00.170",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cohere North AI v1.1.5 was discovered to contain excessively permissive cross-domain policy with untrusted domains. This occurs via the server failing to validate the Origin header of incoming connection requests."
    },
    {
      "lang": "es",
      "value": "Se descubrió que Cohere North AI v1.1.5 contiene una política de dominio cruzado excesivamente permisiva con dominios no confiables. Esto ocurre porque el servidor no valida la cabecera Origin de las solicitudes de conexión entrantes."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "version": "n/a",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-27T19:15:16.362680Z",
          "id": "CVE-2025-61163",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-942"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://cohere.com/north",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/bdadoa/Cohere---North-AI-1.1.5---Vulnerabilities/blob/main/CVE-2025-61163.md",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/bdadoa/Cohere---North-AI-1.1.5---Vulnerabilities/blob/main/CVE-2025-61163.md",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}