CVE-2025-58434Flowise Missing Authentication
Flowise Cloud and Local Deployments have Unauthenticated Password Reset Token Disclosure that Leads to Account Takeover
Published Sep 15, 2025 · Updated Oct 2, 2026 · Also known as GHSA-wgpv-6j63-x5ph, TR-25-0248
Key Facts
Patch immediately- CVE-2025-58434 is a critical-severity vulnerability (CVSS 9.8 v3.1) affecting Flowise (Flowiseai).
- It is not listed in any known-exploited vulnerabilities catalog. Public exploit code is available.
- EPSS estimates a 50% probability of exploitation in the next 30 days.
- Fixed versions are available, including Flowise 3.0.6.
- Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.
Scores
CVSS v3.1
9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS (30-day exploit likelihood)
50%
Higher than 98.8% of all scored CVEs
Exploit maturity
Proof of concept
ATLAS score
49/100
Publication score, see How it works
Exploitation Verdict
KEV listed
Not listed
Federal due date
None
No federal due date
Ransomware use
Not reported
Attributed actors
None named
Exploit & Defence Guidance
Exploit maturity
Proof of concept
Public exploit code
1
Proof-of-concept links
In-the-wild evidence
0
Reports of active use
Advisories And Exploit References
- advisoryhttps://www.cve.org/CVERecord?id=CVE-2025-58434
- advisoryhttps://nvd.nist.gov/vuln/detail/CVE-2025-58434
- advisoryGHSA advisory
- advisoryUSOM advisory
Description
Flowise is a drag & drop user interface to build a customized large language model flow. In version 3.0.5 and earlier, the forgot-password endpoint in Flowise returns sensitive information including a valid password reset tempToken without authentication or verification. This enables any attacker to generate a reset token for arbitrary users and directly reset their password, leading to a complete account takeover (ATO).
This vulnerability applies to both the cloud service (cloud.flowiseai.com) and self-hosted/local Flowise deployments that expose the same API. Commit 9e178d68873eb876073846433a596590d3d9c863 in version 3.0.6 secures password reset endpoints. Several recommended remediation steps are available.
Do not return reset tokens or sensitive account details in API responses. Tokens must only be delivered securely via the registered email channel. Ensure forgot-password responds with a generic success message regardless of input, to avoid user enumeration.
Require strong validation of the tempToken (e.g., single-use, short expiry, tied to request origin, validated against email delivery). Apply the same fixes to both cloud and self-hosted/local deployments.
Log and monitor password reset requests for suspicious activity. Consider multi-factor verification for sensitive accounts.
Affected Products
3 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| FlowiseFlowiseai | >= <= 3.0.5 | 3.0.6 |
Patched Releases
Flowise
3.0.6
Timeline
Publicly disclosed
Sep 15, 2025
Last updated
Oct 2, 2026
Weakness Type
- CWE-306 Missing Authentication for Critical Function
References
- advisorycve.org · CVERecord
- advisorynvd.nist.gov · CVE-2025-58434
- advisoryGHSA advisory
- advisoryUSOM advisory
- exploitExploitDB-52557
FAQ
Common Questions.
Flowise is a drag & drop user interface to build a customized large language model flow.
Affected: Flowise (Flowiseai) versions >= <= 3.0.5. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Public exploit code is available.
Fixed versions are available, including Flowise 3.0.6.
Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.
Is CVE-2025-58434 On Your Attack Surface?
Brandefense matches it against the products discovered on your perimeter and opens a finding the day a CVE like this is listed.
Request A Demo