CVE-2025-69286
RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. In versions prior to 0.22.0, the use of an insecure key generation algorithm in the API key and beta (assistant/agent share auth) token generation process allows these tokens to be mutually derivable. Specifically, both tokens are generated using the same URLSafeTimedSerializer with predictable inputs, enabling an unauthorized user who obtains the shared assistant/agent URL to derive the personal API key. This grants them full control over the assistant/agent owner's account. Version 0.22.0 fixes the issue.
Package Versions Affected
Automatically patch vulnerabilities without upgrading
CVSS Version



Related Resources
References
https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/69xxx/CVE-2025-69286.json, https://github.com/infiniflow/ragflow/blob/v0.20.5/api/apps/systemapp.py#L214-L215, https://github.com/infiniflow/ragflow/blob/v0.20.5/api/utils/init.py#L343, https://github.com/infiniflow/ragflow/blob/v0.20.5/api/utils/apiutils.py#L378, https://github.com/infiniflow/ragflow/commit/a3bb4aadcc3494fb27f2a9933b4c46df8eb532e6, https://github.com/infiniflow/ragflow/security/advisories/GHSA-9j5g-g4xm-57w7, https://nvd.nist.gov/vuln/detail/CVE-2025-69286
