CVE-2025-71327CWE-306

CVE-2025-71327

Critical · published June 26, 2026

CVSS v3.1
9.1
EPSS
1%
Percentile
51.7
In the wild
Unconfirmed
What it is

Flowise contains an authentication bypass vulnerability in the unprotected /api/v1/account/register endpoint that allows unauthenticated attackers to create user accounts. Remote attackers can exploit this endpoint to register arbitrary accounts and authenticate to the system, gaining full API access without credentials.

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00675 · 51.7th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2026-06-26T02:16Z
Affected products (1)
ProductVersionsFixed in
flowiseai/flowiseall versions—
References (3)
https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-v5w9-prxf-w882 · [email protected]https://www.vulncheck.com/advisories/flowise-authentication-bypass-via-unprotected-registration-endpoint · [email protected]https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-v5w9-prxf-w882 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 25 JUN 21:41Z
    Flowise - Authentication Bypass via Unprotected Registration Endpoint
    cvelistv5