CVE-2025-58434 is a critical vulnerability in Flowise (versions 3.0.5 and earlier) that allows unauthenticated attackers to perform a complete account takeover. The flaw resides in the forgot-password endpoint, which improperly returns a valid password reset tempToken without authentication or verification. This enables attackers to reset arbitrary user passwords on both cloud and self-hosted Flowise deployments. Rated 9.8 CRITICAL on the CVSS scale, this vulnerability has a low attack complexity and requires no user interaction, leading to high impacts on confidentiality, integrity, and availability. The EPSS score and FAUCET Risk Score indicate a significant threat. While not listed on CISA's KEV catalog or having public Metasploit/ExploitDB modules, Nuclei templates exist for this critical account takeover, and it has garnered community discussion, suggesting potential for exploitation.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 3.0.6CPE matchmatch criteria | cpe:2.3:a:flowiseai:flowise:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.