FlowiseAI Password Reset Token Vulnerability Enables Account Takeover

A critical vulnerability in FlowiseAI has been disclosed that enables attackers to takeover user accounts with minimal effort. The flaw, tracked as CVE-2025-58434, affects FlowiseAI’s npm package flowise on both cloud-hosted and self-hosted deployments. It lies in the password reset endpoint /api/v1/account/forgot-password, where the API response discloses sensitive user details and a valid tempToken that can be used immediately to reset the target’s password.

An attacker only needs the victim’s email address, and the process requires two HTTP requests: first a POST to the forgot-password endpoint to obtain the reset token, then using the token at the reset-password endpoint to set a new password. The vulnerability carries a CVSS score of 9.8, described as unauthenticated, with no user interaction and low attack complexity, enabling complete access to accounts and potentially broader compromise.

The report notes no patches are available for FlowiseAI versions below 3.0.5, and organisations should monitor for suspicious password-reset activity and consider restricting access until fixes are released, according to Security Researcher.