Use of Hard-coded Cryptographic Key Vulnerability in Agentflow by Flowring

CVE-2025-11899

What is CVE-2025-11899?

Agentflow, developed by Flowring, contains a vulnerability that involves the use of a hard-coded cryptographic key. This flaw allows unauthenticated remote attackers to exploit the fixed key to generate verification information, enabling them to log into the system as any user. To successfully exploit this vulnerability, an attacker needs to acquire a valid user ID beforehand, making user enumeration a potential precursor to exploiting this issue. Organizations using Agentflow should take immediate action to mitigate this security threat.

References