Password Reset Vulnerability in Flowise Affects User Accounts

CVE-2025-58434

What is CVE-2025-58434?

The Flowise platform contains a significant vulnerability in its forgot-password endpoint, which can return sensitive information, including a valid password reset token, without the necessary authentication or verification. This flaw allows attackers to generate reset tokens for arbitrary users, enabling them to fully compromise user accounts. The issue affects both the cloud service and self-hosted deployments of Flowise. It is essential to secure password reset processes by ensuring tokens are only delivered through registered email channels, logging password reset requests, and validating tokens stringently. Implementing these security measures can mitigate the risk of unauthorized account access.

References