CVE-2025-61163: missing Origin check enables

CISO Take

Cohere North AI 1.1.5 accepts cross-origin connection requests without validating the Origin header, meaning any website an authenticated user visits can silently open a connection to their North AI session and interact with it as if it were the legitimate client. There is no CVSS score, EPSS percentile, KEV listing, or Nuclei template yet, so this has not been triaged or weaponized at scale — but a public write-up with reproduction steps already exists on GitHub, which shortens the time to a working exploit for anyone motivated to build one. Because North is an agentic AI platform, a successful cross-site request could let an attacker ride a victim's session to read conversation history, extract data the agent has access to, or trigger agent actions without ever stealing a credential. Until Cohere ships a patched build, mitigate by never leaving North AI sessions open in a browser also used for untrusted browsing, restrict egress/CORS at a reverse proxy in front of North where possible, and monitor for WebSocket/API connections to North AI with unexpected or missing Origin headers. Track the vendor advisory at cohere.com/north for a fix version and apply it as soon as it lands.

Sources: NVD GitHub ATLAS cohere.com

What is the risk?

No CVSS vector or EPSS score has been assigned, and there is no evidence of KEV listing, active exploitation, or an automated scanner template, so near-term mass-exploitation risk is currently low. However, the vulnerability class (missing Origin validation on cross-domain requests) is well understood and trivially exploitable once a target is identified — a working PoC is already public on GitHub, which meaningfully lowers the bar for a motivated attacker. The real risk driver is exposure: any organization running an internet-reachable, authenticated North AI deployment where staff also browse untrusted web content is exposed to session-riding attacks that require no phishing of credentials, only a visit to a malicious or compromised page.

How does the attack unfold?

Delivery

Attacker gets a victim with an active, authenticated Cohere North AI session to load a malicious webpage, either via social engineering or a compromised site.

AML.T0078

Exploitation

The malicious page's script opens a cross-origin request/connection to the North AI server, which accepts it because it never validates the Origin header.

AML.T0049

Session riding

Using the victim's existing session credentials carried by the browser, the attacker's script queries the AI agent and retrieves data or triggers actions the agent has access to.

AML.T0085

Impact

Sensitive conversation data, tool outputs, or unauthorized agent actions are exfiltrated or executed under the victim's identity without their knowledge.

Delivery

Attacker gets a victim with an active, authenticated Cohere North AI session to load a malicious webpage, either via social engineering or a compromised site.

AML.T0078

Exploitation

The malicious page's script opens a cross-origin request/connection to the North AI server, which accepts it because it never validates the Origin header.

AML.T0049

Session riding

Using the victim's existing session credentials carried by the browser, the attacker's script queries the AI agent and retrieves data or triggers actions the agent has access to.

AML.T0085

Impact

Sensitive conversation data, tool outputs, or unauthorized agent actions are exfiltrated or executed under the victim's identity without their knowledge.

How severe is it?

CVSS 3.1

N/A

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

Moderate

What should I do?

1 step

1) Check for a Cohere North AI release newer than 1.1.5 and patch as soon as it is available — monitor cohere.com/north and the linked GitHub advisory for a fix. 2) Until patched, front North AI with a reverse proxy or WAF that enforces a strict Origin/Referer allowlist for API and WebSocket upgrade requests. 3) Enforce SameSite=Strict (or Lax) cookies and short session lifetimes for North AI sessions to reduce the exploitation window. 4) Instruct users with access to North AI not to browse untrusted sites in the same browser session/profile used for North AI. 5) Detection: alert on connection requests to North AI endpoints with Origin headers that don't match your organization's known domains, and review access/audit logs for anomalous agent actions correlated with unusual client origins.

How is it classified?

Auth Bypass Data Leakage Agent API AML.T0049 - Exploit Public-Facing Application AML.T0078 - Drive-by Compromise AML.T0085 - Data from AI Services

Which compliance frameworks are affected?

This CVE is relevant to:

NIST AI RMF

MANAGE-2.3 - AI system security and resilience monitoring

OWASP LLM Top 10

LLM02 - Sensitive Information Disclosure

Frequently Asked Questions

What is CVE-2025-61163?

Cohere North AI 1.1.5 accepts cross-origin connection requests without validating the Origin header, meaning any website an authenticated user visits can silently open a connection to their North AI session and interact with it as if it were the legitimate client. There is no CVSS score, EPSS percentile, KEV listing, or Nuclei template yet, so this has not been triaged or weaponized at scale — but a public write-up with reproduction steps already exists on GitHub, which shortens the time to a working exploit for anyone motivated to build one. Because North is an agentic AI platform, a successful cross-site request could let an attacker ride a victim's session to read conversation history, extract data the agent has access to, or trigger agent actions without ever stealing a credential. Until Cohere ships a patched build, mitigate by never leaving North AI sessions open in a browser also used for untrusted browsing, restrict egress/CORS at a reverse proxy in front of North where possible, and monitor for WebSocket/API connections to North AI with unexpected or missing Origin headers. Track the vendor advisory at cohere.com/north for a fix version and apply it as soon as it lands.

Is CVE-2025-61163 actively exploited?

No confirmed active exploitation of CVE-2025-61163 has been reported, but organizations should still patch proactively.

How to fix CVE-2025-61163?

1) Check for a Cohere North AI release newer than 1.1.5 and patch as soon as it is available — monitor cohere.com/north and the linked GitHub advisory for a fix. 2) Until patched, front North AI with a reverse proxy or WAF that enforces a strict Origin/Referer allowlist for API and WebSocket upgrade requests. 3) Enforce SameSite=Strict (or Lax) cookies and short session lifetimes for North AI sessions to reduce the exploitation window. 4) Instruct users with access to North AI not to browse untrusted sites in the same browser session/profile used for North AI. 5) Detection: alert on connection requests to North AI endpoints with Origin headers that don't match your organization's known domains, and review access/audit logs for anomalous agent actions correlated with unusual client origins.

What systems are affected by CVE-2025-61163?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, model serving, LLM API front-ends.

What is the CVSS score for CVE-2025-61163?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

agent frameworksmodel servingLLM API front-ends

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

AML.T0078 Drive-by Compromise

AML.T0085 Data from AI Services

Compliance Controls Affected

NIST AI RMF: MANAGE-2.3

OWASP LLM Top 10: LLM02

What are the technical details?

Original Advisory

Cohere North AI v1.1.5 was discovered to contain excessively permissive cross-domain policy with untrusted domains. This occurs via the server failing to validate the Origin header of incoming connection requests.

Exploitation Scenario

An attacker hosts a malicious webpage (or compromises a page a target is likely to visit) containing JavaScript that opens a cross-origin connection to the victim organization's Cohere North AI instance. Because North AI's server does not validate the Origin header, it accepts the connection as if it came from its own trusted frontend and honors the victim's existing authenticated session cookies. The attacker's script then issues API/WebSocket calls through this hijacked connection — reading the agent's conversation history, pulling data the agent has access to via connected tools, or issuing new prompts/commands that the agent executes with the victim's privileges — all without ever needing to steal a password or API key.