Use of Hard-coded Cryptographic Key Vulnerability in Agentflow by Flowring

CVE-2025-11899

What is CVE-2025-11899?

Agentflow, developed by Flowring, contains a vulnerability that involves the use of a hard-coded cryptographic key. This flaw allows unauthenticated remote attackers to exploit the fixed key to generate verification information, enabling them to log into the system as any user. To successfully exploit this vulnerability, an attacker needs to acquire a valid user ID beforehand, making user enumeration a potential precursor to exploiting this issue. Organizations using Agentflow should take immediate action to mitigate this security threat.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References