Critical · published September 12, 2025
CVSS calls it critical at 9.8. It sits in the 98.9th percentile for exploit probability.
🚨 An unprotected `forgot-password` endpoint is the golden ticket for attackers! Anyone can grab a valid reset token without breaking a sweat. 🔥 Think of it like a hotel that hands out room keys without checking IDs — anyone could waltz in and take over someone else's suite! This vulnerability makes it surprisingly easy for attackers to reset passwords and lock out legitimate users. An attacker could exploit this vulnerability to completely take over any account on the Flowise platform, accessing sensitive user data and causing absolute chaos! Imagine your personal information being compromised and someone else controlling your account — downright terrifying!
Think of it like a hotel that hands out room keys without checking IDs — anyone could waltz in and take over someone else's suite! This vulnerability makes it surprisingly easy for attackers to reset passwords and lock out legitimate users. In versions 3.0.5 and earlier, Flowise's `forgot-password` endpoint returns a valid password reset token without requiring any authentication, allowing attackers to hijack user accounts.
An attacker could exploit this vulnerability to completely take over any account on the Flowise platform, accessing sensitive user data and causing absolute chaos! Imagine your personal information being compromised and someone else controlling your account — downright terrifying! Upgrade to version 3.0.6 to secure the password reset endpoints immediately. Ensure sensitive information isn’t exposed in API responses, and implement strong validation for `tempToken` such as single-use tokens and short expiry times. Log and monitor reset requests to catch any suspicious activity! You've got this! By taking these steps, you'll fortify your defenses and keep those pesky attackers at bay! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| flowiseai/flowise | < 3.0.6 | 3.0.6 |