PT-2025-37340 · Flowise · Flowise

Arthurgervais

+1

·

Published

2025-09-12

·

Updated

2026-04-14

·

CVE-2025-58434

CVSS v3.1

10

Critical

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Flowise and Affected Versions Flowise versions 3.0.5 and earlier
Description Flowise is a drag & drop user interface to build a customized large language model flow. The /api/v1/account/forgot-password endpoint returns sensitive information, including a valid password reset tempToken, without authentication or verification. This allows an attacker to generate a reset token for any user and directly reset their password, leading to a complete account takeover (ATO). This issue affects both the cloud service (cloud.flowiseai.com) and self-hosted/local Flowise deployments. The tempToken can be reused immediately in the /api/v1/account/reset-password endpoint to reset the password of the targeted account without any email verification or user interaction. Exploitation requires only the victim’s email address. Approximately 17,000+ instances are found on the internet.
Recommendations Do not return reset tokens or sensitive account details in API responses. Tokens must only be delivered securely via the registered email channel. Ensure forgot-password responds with a generic success message regardless of input, to avoid user enumeration. Require strong validation of the tempToken (e.g., single-use, short expiry, tied to request origin, validated against email delivery). Apply the same fixes to both cloud and self-hosted/local deployments. Log and monitor password reset requests for suspicious activity. Consider multi-factor verification for sensitive accounts.

Exploit

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

BDU:2025-13370
CVE-2025-58434
GHSA-WGPV-6J63-X5PH

Affected Products

Flowise