Authentication Bypass Vulnerability in Flowise by FlowiseAI

CVE-2026-41276

What is CVE-2026-41276?

Flowise, an intuitive drag-and-drop user interface for creating large language model flows, has a significant security flaw in its AccountService class prior to version 3.1.0. This vulnerability allows remote attackers to bypass authentication protocols, enabling them to reset user passwords without proper verification. By exploiting this flaw, an attacker can craft a request to the '/api/v1/account/reset-password' endpoint using a null or empty reset token, which is stored by default when a user has not generated a reset token or has previously reset their password. As a result, an attacker who knows a user's email can easily compromise their account by setting a new password of their choice. This vulnerability has been addressed in version 3.1.0.

References