CVE-2025-58434

The forgot-password endpoint in Flowise 3.0.5 and earlier returns sensitive information, including a valid password reset tempToken, in an API response that requires no authentication or verification (CWE-306, missing authentication for a critical function). An unauthenticated attacker who submits a reset request for any known or guessed user can read the tempToken directly from the response and reset that user's password, achieving complete account takeover with no privileges or user interaction required. Both the hosted cloud service (cloud.flowiseai.com) and self-hosted or local Flowise deployments that expose the same API are affected. Flowise fixed the issue in version 3.0.6 via commit 9e178d68873eb876073846433a596590d3d9c863 by securing the password reset endpoints. A public proof-of-concept exists and the issue is not yet in CISA KEV, but EPSS assigns a 49.9% probability of exploitation within 30 days (99th percentile), so broad scanning and exploitation attempts are considered likely.

What to do: Upgrade self-hosted Flowise to version 3.0.6 or later, which includes fix commit 9e178d68873eb876073846433a596590d3d9c863 securing the password reset endpoints. Until patched, restrict and rate-limit access to the forgot-password and password-reset endpoints, stop returning reset tokens or account details in API responses, and monitor reset activity for anomalies. For the cloud service, confirm the provider-side fix applies and enable multi-factor verification on sensitive accounts.