CVE-2025-58434: Flowise forgot-password endpoint leaks reset token, enabling account takeover

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable account takeover with CVSS 9.8 and high EPSS, though no confirmed in-the-wild exploitation is documented.

What it is

Flowise 3.0.5 and earlier returns a valid password reset tempToken and sensitive account details from the forgot-password endpoint without authentication or verification. Any attacker can request a token for an arbitrary user and reset that user's password, achieving full account takeover. The flaw affects both the cloud service and self-hosted deployments exposing the same API.

Impact

An unauthenticated attacker gains complete control of any targeted account, including administrative accounts, by resetting the victim's password. This can lead to full compromise of the Flowise instance and any connected LLM flows, credentials or data.

Attack surface

Reachable over the network via the forgot-password API endpoint with no authentication and no user interaction required, per the CVSS vector AV:N/AC:L/PR:N/UI:N. Both cloud and self-hosted deployments that expose the endpoint are affected.

Exploitation

Not listed in CISA KEV and no ransomware usage documented, but EPSS is 0.49894 (98.8th percentile) and the vendor advisory is tagged Exploit, indicating public exploit detail exists.

What to do

• Upgrade to Flowise 3.0.6 or later, which contains commit 9e178d68873eb876073846433a596590d3d9c863 securing the password reset endpoints.
• Stop returning reset tokens or account details in API responses; deliver tokens only through the registered email channel.
• Make forgot-password always return a generic success message to prevent user enumeration.
• Enforce single-use, short-expiry tempTokens tied to request origin and validated against email delivery.
• Apply the same fixes to cloud and self-hosted deployments, and consider MFA for sensitive accounts.

Detection

• Monitor forgot-password API responses for tempToken or account detail leakage.
• Alert on password reset requests followed by immediate password changes or logins from new IPs or user agents.
• Correlate multiple reset requests across different accounts from a single source.
• Review Flowise access logs for unauthenticated calls to the forgot-password endpoint at unusual rates.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.