CVE-2025-58434 Flowise Cloud and Local Deployments have Unauthenticated Password Reset Token Disclosure that Leads to Account Takeover

🗓️ 12 Sep 2025 17:37:08Reported by GitHub_MType

Flowise exposes unauthenticated password reset tokens in cloud and local deployments.

Reporter	Title	Published	Views	Family All 30
GithubExploit	Exploit for Missing Authentication for Critical Function in Flowiseai Flowise	10 May 202607:11	–	githubexploit
GithubExploit	Exploit for Missing Authentication for Critical Function in Flowiseai Flowise	14 Apr 202606:50	–	githubexploit
GithubExploit	Exploit for Missing Authentication for Critical Function in Flowiseai Flowise	20 Apr 202609:52	–	githubexploit
GithubExploit	Exploit for Missing Authentication for Critical Function in Flowiseai Flowise	13 Apr 202601:54	–	githubexploit
GithubExploit	Exploit for Missing Authentication for Critical Function in Flowiseai Flowise	15 Apr 202611:54	–	githubexploit
GithubExploit	Exploit for Missing Authentication for Critical Function in Flowiseai Flowise	12 Apr 202616:52	–	githubexploit
GithubExploit	Exploit for Missing Authentication for Critical Function in Flowiseai Flowise	14 May 202621:15	–	githubexploit
GithubExploit	Exploit for Code Injection in Flowiseai Flowise	15 Apr 202612:47	–	githubexploit
GithubExploit	Exploit for Missing Authentication for Critical Function in Flowiseai Flowise	11 Oct 202517:53	–	githubexploit
Circl	CVE-2025-58434	12 Sep 202517:22	–	circl

[
  {
    "vendor": "FlowiseAI",
    "product": "Flowise",
    "versions": [
      {
        "version": "<= 3.0.5",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/FlowiseAI/Flowise/commit/9e178d68873eb876073846433a596590d3d9c863
github	www.github.com/FlowiseAI/Flowise/security/advisories/GHSA-wgpv-6j63-x5ph

15 Sep 2025 15:31Current

CVSS 3.19.8

EPSS0.50118

CWE-306