Session hijacking and code execution via credentialed CORS

Origin validation errors in Langflow 1.6.9 and earlier allow remote attackers to hijack sessions and execute code through a malicious webpage. The /api/v1/refresh endpoint trusts a SameSite=None refresh_token_lf cookie while wildcard CORS permits credentialed cross-origin reads, exposing fresh access and refresh tokens to an attacker-controlled origin. A victim must have an active session and visit the malicious page; the stolen access token reaches authenticated code-validation functionality with server-process privileges.