Account Takeover Vulnerability in RAGFlow by Infiniflow

CVE-2025-48187

What is CVE-2025-48187?

RAGFlow, a product by Infiniflow, is vulnerable to account takeover attacks due to a flaw in its email verification process. This vulnerability allows attackers to exploit weak rate limiting controls, enabling them to successfully conduct brute-force attacks against email verification codes. The verification codes, consisting of six digits, can be targeted to manipulate account registration, logins, and password resets. Without effective rate limiting measures in place, unauthorized parties may easily compromise user accounts, posing significant risks to user security and data integrity.

References