ComfyUI releases through version 0.13.0 contain a flaw in the create_origin_only_middleware function defined in server.py. The function fails to enforce the proper origin header check, allowing an attacker to craft HTTP requests that are treated as if they originated from an authorized source. Consequently, a remote user can perform actions on the server with the privileges of the victim’s session, leading to cross‑site request forgery.

The vulnerability impacts any installation of ComfyUI that includes the unpatched create_origin_only_middleware implementation, i.e., versions up to and including 0.13.0. The affected product is the ComfyUI application, and the vendor is listed as n/a:ComfyUI.

The CVSS score of 5.3 denotes a moderate risk, and the EPSS score is unavailable while the vulnerability is not listed in CISA KEV. A remote attacker can exploit the flaw by sending forged requests; the presence of missing authorization checks (CWE‑862) coupled with the CSRF weakness (CWE‑352) means that if the victim is authenticated, the attacker can cause the server to perform privileged operations on their behalf. No public exploit has been recorded, but the vulnerability is remotely exploitable and can lead to credential misuse or unauthorized actions.