PoC Available: FlowiseAI Flaw (CVE-2025-58434) Allows Full Account Takeover (CVSS 9.8)

FlowiseAI’s open‑source platform has a critical flaw, CVE‑2025‑58434, rated CVSS 9.8, that allows unauthenticated account takeover across cloud and self‑hosted deployments. The weakness lies in the forgot-password endpoint, which returns a valid password reset tempToken and other sensitive details without authentication or verification, enabling any attacker to generate a reset token for arbitrary users and directly reset their password.

The vulnerable endpoint is /api/v1/account/forgot-password and the tempToken can be reused in /api/v1/account/reset-password to change a target’s password without email verification or user interaction, according to the advisory. The advisory notes that exploitation only requires knowledge of a victim’s email and that any unauthenticated attacker can take over arbitrary accounts, including administrators.

FlowiseAI has not yet released a patch, with versions prior to 3.0.5 remaining vulnerable, and recommended mitigations include not returning reset tokens in API responses, delivering tokens via secure email, and enforcing single-use tokens with short lifetimes. According to the advisory, this effectively allows unauthenticated attackers to take over arbitrary accounts by requesting a reset for their email.