Overview
CVE-2025-58434 is a serious vulnerability found in the `forgot-password` endpoint of Flowise, a drag & drop user interface used to build customized large language model flows. In earlier versions, specifically version 3.0.5 and below, this endpoint has been found to return sensitive information, including a valid password reset `tempToken`, without any form of authentication or verification. This vulnerability paves the way for potential attackers to generate a reset token for any user, thereby enabling them to reset the user’s password and take over the account. This vulnerability is especially significant given Flowise’s widespread use in both cloud service (`cloud.flowiseai.com`) and self-hosted/local deployments.
Vulnerability Summary
CVE ID: CVE-2025-58434
Severity: Critical (9.8)
Attack Vector: Network
Privileges Required: None
User Interaction: None
Impact: Potential system compromise or data leakage
Affected Products
Escape the Surveillance Era
Most apps won’t tell you the truth.
They’re part of the problem.
Phone numbers. Emails. Profiles. Logs.
It’s all fuel for surveillance.
Ameeba Chat gives you a way out.
- • No phone number
- • No email
- • No personal info
- • Anonymous aliases
- • End-to-end encrypted
Chat without a trace.
Product | Affected Versions
Flowise Cloud Service | ≤ 3.0.5
Flowise Self-Hosted/Local Deployments | ≤ 3.0.5
How the Exploit Works
The exploit takes advantage of the `forgot-password` endpoint in Flowise. As the endpoint doesn’t require any form of authentication or verification, an attacker simply has to send a password reset request for any arbitrary user. The system then returns a valid `tempToken` in the API response, which the attacker can use to reset the password of the targeted user, leading to a complete account takeover.
Conceptual Example Code
Here’s a conceptual example of how this vulnerability might be exploited, using a simple HTTP POST request:
POST /api/forgot-password HTTP/1.1
Host: cloud.flowiseai.com
Content-Type: application/json
{
"username": "targeted.user@example.com"
}In the above example, the attacker sends a password reset request for the targeted user’s account. The server responds with a `tempToken`, which can then be used to reset the user’s password, potentially leading to unauthorized access and a complete account takeover. The actual returned `tempToken` will vary, and the attacker would use it in a subsequent request to reset the password.
