Flowise: AccountService resetPassword Authentication Bypass Vulnerability

published 2026-04-16 6 mo ago modified 2026-10-26 13 d ago also GHSA-f6hc-c5jr-878p , EUVD-2026-25295

cvss: 9.8; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 6.9%; EPSS 6.9% chance of exploitation in 30 days, percentile 94%
public exploits: 0; none known

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, this vulnerability allows remote attackers to bypass authentication on affected installations of FlowiseAI Flowise. Authentication is not required to exploit this vulnerability. The specific flaw exists within the resetPassword method of the AccountService class. There is no check performed to ensure that a password reset token has actually been generated for a user account. By default the value of the reset token stored in a users account is null, or an empty string if they've reset their password before. An attacker with knowledge of the user's email address can submit a request to the "/api/v1/account/reset-password" endpoint containing a null or empty string reset token value and reset that user's password to a value of their choosing. This vulnerability is fixed in 3.1.0.

Patch / fix

fixed in 2

npm flowise 3.1.0
flowiseai flowise 3.1.0

CISA SSVC

Exploitation: Proof of concept is public
Automatable: no
Technical impact: total
Assessed: 6 mo ago (2026-04-24)

Exploit prediction

6.87% chance of exploitation in the next 30 days, higher than 94% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

github.com https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-f6hc-c5jr-878p referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	4.0	7.7	CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CNA	4.0	7.7	CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GitHub	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem	package	affected	fixed in
npm	flowise	<3.1.0	3.1.0

Affected products

FlowiseAI Flowise

Classification

Weakness

CWE-287 Improper Authentication

References

github.com /FlowiseAI/Flowise/security/advisories/GHSA-f6hc-c5jr-878p
exploit, web, vendor-advisory
nvd.nist.gov /vuln/detail/CVE-2026-41276
advisory
github.com /FlowiseAI/Flowise
package

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary