CVE-2025-58434 in Flowise
Summary
by MITRE • 09/12/2025
Flowise is a drag & drop user interface to build a customized large language model flow. In version 3.0.5 and earlier, the `forgot-password` endpoint in Flowise returns sensitive information including a valid password reset `tempToken` without authentication or verification. This enables any attacker to generate a reset token for arbitrary users and directly reset their password, leading to a complete account takeover (ATO). This vulnerability applies to both the cloud service (`cloud.flowiseai.com`) and self-hosted/local Flowise deployments that expose the same API. Commit 9e178d68873eb876073846433a596590d3d9c863 secures password reset endpoints. Several recommended remediation steps are available. Do not return reset tokens or sensitive account details in API responses. Tokens must only be delivered securely via the registered email channel. Ensure `forgot-password` responds with a generic success message regardless of input, to avoid user enumeration. Require strong validation of the `tempToken` (e.g., single-use, short expiry, tied to request origin, validated against email delivery). Apply the same fixes to both cloud and self-hosted/local deployments. Log and monitor password reset requests for suspicious activity. Consider multi-factor verification for sensitive accounts.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/10/2026
CVE-2025-58434 represents a critical authentication flaw in Flowise version 3.0.5 and earlier, where the forgot-password endpoint exposes sensitive information without proper authentication or verification mechanisms. This vulnerability manifests as a direct account takeover risk, allowing attackers to generate valid password reset tokens for arbitrary user accounts and subsequently reset passwords without authorization. The flaw exists in both cloud service deployments at cloud.flowiseai.com and self-hosted/local installations that expose the same API endpoints, making it a widespread concern across all deployment models. The technical implementation error stems from the endpoint's failure to validate user identity or verify the legitimacy of reset requests before returning sensitive authentication tokens.
The vulnerability directly maps to CWE-306, which addresses missing authentication for critical functions, and aligns with ATT&CK technique T1078.004 for valid accounts, specifically targeting credential access through compromised authentication mechanisms. The flaw enables attackers to perform user enumeration by observing different responses for valid versus invalid email addresses, while simultaneously providing them with the means to fully compromise targeted accounts. The exposed tempToken represents a critical security weakness that bypasses normal authentication flows and allows unauthorized access to user accounts. The vulnerability's impact extends beyond simple privilege escalation to full account takeover, which can result in data breaches, unauthorized access to sensitive information, and potential lateral movement within compromised environments.
The operational impact of this vulnerability is severe, as it allows attackers to gain unauthorized access to user accounts without requiring any prior knowledge of existing credentials. This creates a significant risk for organizations using Flowise for enterprise applications where user data security is paramount. The vulnerability affects the entire user base, as any attacker with access to the application can exploit it regardless of their initial authentication state. Security monitoring becomes compromised because legitimate users may be unable to distinguish between normal and malicious reset requests, while attackers can systematically enumerate valid user accounts and then exploit them. The exposed tokens can be used immediately for authentication, making this a high-severity vulnerability that requires immediate remediation.
Effective mitigation strategies must include implementing proper authentication checks before any sensitive information is returned in API responses. The forgot-password endpoint should respond with generic success messages regardless of whether the email address exists in the system, preventing user enumeration attacks. Password reset tokens must be delivered exclusively through secure email channels and should include strong validation mechanisms such as single-use tokens, short expiration times, and binding to the original request origin. Organizations should implement comprehensive logging and monitoring of all password reset activities to detect suspicious patterns and potential abuse. The fix requires applying consistent security measures across all deployment models including cloud and self-hosted environments, ensuring that both platforms implement the same robust validation and token delivery mechanisms. Additionally, implementing multi-factor authentication for sensitive accounts provides an additional layer of protection against account compromise even if the password reset mechanism is bypassed.