PT-2026-34744 · Flowise · Flowise

Published 2026-04-16 · Updated 2026-04-30 · CVE-2026-41276

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.0

Description Remote attackers can bypass authentication in Flowise. The issue exists within the resetPassword() function of the AccountService class, where the system fails to verify if a password reset token was actually generated for a user account. Since the reset token is null or an empty string by default, an attacker knowing a user's email address can send a request to the '/api/v1/account/reset-password' endpoint with a null or empty reset token value to change the user's password.

Recommendations Update to version 3.1.0.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2026-41276

GHSA-F6HC-C5JR-878P

ZDI-26-300

Affected Products

Flowise

References · 7

• 🔥 https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-f6hc-c5jr-878p · Exploit
• https://osv.dev/vulnerability/GHSA-f6hc-c5jr-878p · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-26-300 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-41276 · Security Note
• https://github.com/FlowiseAI/Flowise · Note
• https://twitter.com/TheZDIBugs/status/2049937525142065411 · Twitter Post
• https://twitter.com/CVEnew/status/2047428069028397398 · Twitter Post