FlowiseAI Flowise up to 3.0.5 forgot-password Endpoint missing authentication

Summaryinfo

A vulnerability, which was classified as critical, was found in FlowiseAI Flowise up to 3.0.5. Affected by this issue is some unknown functionality of the component forgot-password Endpoint. The manipulation results in missing authentication. This vulnerability was named CVE-2025-58434. The attack may be performed from remote. In addition, an exploit is available. Applying a patch is advised to resolve this issue.

Detailsinfo

A vulnerability was found in FlowiseAI Flowise up to 3.0.5. It has been classified as critical. Affected is some unknown functionality of the component forgot-password Endpoint. The manipulation with an unknown input leads to a missing authentication vulnerability. CWE is classifying the issue as CWE-306. The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Flowise is a drag & drop user interface to build a customized large language model flow. In version 3.0.5 and earlier, the `forgot-password` endpoint in Flowise returns sensitive information including a valid password reset `tempToken` without authentication or verification. This enables any attacker to generate a reset token for arbitrary users and directly reset their password, leading to a complete account takeover (ATO). This vulnerability applies to both the cloud service (`cloud.flowiseai.com`) and self-hosted/local Flowise deployments that expose the same API. Commit 9e178d68873eb876073846433a596590d3d9c863 secures password reset endpoints. Several recommended remediation steps are available. Do not return reset tokens or sensitive account details in API responses. Tokens must only be delivered securely via the registered email channel. Ensure `forgot-password` responds with a generic success message regardless of input, to avoid user enumeration. Require strong validation of the `tempToken` (e.g., single-use, short expiry, tied to request origin, validated against email delivery). Apply the same fixes to both cloud and self-hosted/local deployments. Log and monitor password reset requests for suspicious activity. Consider multi-factor verification for sensitive accounts.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2025-58434 since 09/01/2025. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Technical details are unknown but a public exploit is available.

The exploit is shared for download at exploit-db.com. It is declared as proof-of-concept.

Applying the patch 9e178d68873eb876073846433a596590d3d9c863 is able to eliminate this problem. The bugfix is ready for download at github.com.

The vulnerability is also documented in the databases at Exploit-DB (52557) and CERT Bund (WID-SEC-2025-2048). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Affected

• Open Source Flowise

Productinfo

Vendor

• FlowiseAI

Name

• Flowise

Version

• 3.0.0
• 3.0.1
• 3.0.2
• 3.0.3
• 3.0.4
• 3.0.5

License

• open-source

Website

• Product: https://github.com/FlowiseAI/Flowise/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion