CVE-2025-58434

🗓️ 12 Sep 2025 17:37:08Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 13 Media mentions👁 79 Views🌐 WEB

Unauthenticated password reset token disclosure enables account takeover in Flowise deployments.

Reporter	Title	Published	Views	Family All 32
GithubExploit	Exploit for Missing Authentication for Critical Function in Flowiseai Flowise	10 May 202607:11	–	githubexploit
GithubExploit	Exploit for Missing Authentication for Critical Function in Flowiseai Flowise	14 Apr 202606:50	–	githubexploit
GithubExploit	Exploit for Missing Authentication for Critical Function in Flowiseai Flowise	20 Apr 202609:52	–	githubexploit
GithubExploit	Exploit for Missing Authentication for Critical Function in Flowiseai Flowise	13 Apr 202601:54	–	githubexploit
GithubExploit	Exploit for Missing Authentication for Critical Function in Flowiseai Flowise	15 Apr 202611:54	–	githubexploit
GithubExploit	Exploit for Missing Authentication for Critical Function in Flowiseai Flowise	12 Apr 202616:52	–	githubexploit
GithubExploit	Exploit for Missing Authentication for Critical Function in Flowiseai Flowise	14 May 202621:15	–	githubexploit
GithubExploit	Exploit for Missing Authentication for Critical Function in Flowiseai Flowise	26 Jun 202620:41	–	githubexploit
GithubExploit	Exploit for Code Injection in Flowiseai Flowise	15 Apr 202612:47	–	githubexploit
GithubExploit	Exploit for Missing Authentication for Critical Function in Flowiseai Flowise	11 Oct 202517:53	–	githubexploit

NVD

Vulners

Node

flowiseai flowiseRange<3.0.6

[
  {
    "vendor": "FlowiseAI",
    "product": "Flowise",
    "versions": [
      {
        "version": "<= 3.0.5",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/FlowiseAI/Flowise/commit/9e178d68873eb876073846433a596590d3d9c863
github	www.github.com/FlowiseAI/Flowise/security/advisories/GHSA-wgpv-6j63-x5ph

Parameter	Position	Path	Description	CWE
email	request body	/api/v1/account/forgot-password	Unauthenticated forgot-password exposure leaks tempToken in response enabling account takeover	CWE-306
email	request body	/api/v1/account/reset-password	Reset password endpoint accepts leaked tempToken to set a new password after token disclosure	CWE-306
tempToken	request body	/api/v1/account/reset-password	Reset password endpoint accepts leaked tempToken to set a new password after token disclosure	CWE-306
password	request body	/api/v1/account/reset-password	Reset password endpoint accepts leaked tempToken to set a new password after token disclosure	CWE-306
mcpServerConfig	request body	/api/v1/node-load-method/customMCP	RCE via unsafe evaluation of user-supplied mcpServerConfig in Node.js environment	CWE-306

17 Jun 2026 09:44Current

6.7Medium risk

Vulners AI Score6.7

CVSS 3.19.8

EPSS0.50118

SSVC

CWE-306