CVE-2025-58434 - Flowise AI Unauthenticated Password Reset

Overview

CVE ID: CVE-2025-58434
Affected Software: Flowise AI
Vulnerable Versions: <= 3.0.5
Fixed Version: 3.0.6 and later
Severity: Critical
Author: arensballiu
Date: 2025

Description

Flowise AI versions up to and including 3.0.5 contain a broken authentication flaw in the password reset flow. The /api/v1/account/forgot-password endpoint returns a temporary reset token (tempToken) directly in its API response without requiring any form of prior authentication or email verification.

An unauthenticated attacker who knows (or can enumerate) a valid email address can:

1. Confirm whether the email exists via a login attempt response message.
2. Trigger a password reset request for that email.
3. Extract the tempToken directly from the API response.
4. Use that token to set an arbitrary new password on the victim's account.

This vulnerability bypasses the intended email-based verification flow entirely, as the token is leaked in the HTTP response rather than sent only to the account owner's email inbox.

Affected Endpoints

Endpoint	Method	Purpose
/api/v1/auth/login	POST	Used to verify if an email account exists
/api/v1/account/forgot-password	POST	Triggers reset and leaks tempToken in response
/api/v1/account/reset-password	POST	Completes the password change using the token

Proof of Concept

File: CVE-2025-58434_POC.py

Requirements

• Python 3.x
• requests library

pip install requests

Usage

python3 CVE-2025-58434_POC.py -e <target_email> -u <target_url> [-p <new_password>]

Arguments

Flag	Long Form	Required	Description
-e	--email	Yes	Target account email address
-u	--url	Yes	Base URL of the Flowise instance
-p	--password	No	New password to set (defaults to password)

Example

python3 CVE-2025-58434_POC.py -e [email protected] -u https://flowise.example.com -p P@ssw0rd!

Expected Output

[+] Email [email protected] exists!
[!] Sending forgot password request
[!] Sending reset password request
[+] Password Changed Successfully to: P@ssw0rd!

Root Cause

The password reset API was designed to send the tempToken to the user's email, but the server also included it directly in the JSON response body. This means any caller, authenticated or not, receives the token immediately upon making the request, rendering the email delivery step irrelevant.

Additionally, the email enumeration is possible because the login endpoint returns a distinct error message ("Incorrect Email or Password") only when the email exists, making it trivial to confirm valid accounts before launching the attack.

Remediation

• Upgrade to Flowise AI 3.0.6 or later, which removes the token from the API response.
• Ensure the tempToken is transmitted exclusively via the registered email address.
• Implement rate limiting on the forgot-password endpoint to prevent abuse.
• Normalize login error messages to prevent email enumeration (e.g., always return the same message regardless of whether the email exists).

Disclaimer

This proof of concept is provided for educational and authorized security research purposes only. Use of this script against systems without explicit written permission is illegal and unethical. The author and contributors assume no liability for misuse.