What is CVE-2025-58434?
Flowise is a drag & drop user interface to build a customized large language model flow. In version 3.0.5 and earlier, the `forgot-password` endpoint in Flowise returns sensitive information including a valid password reset `tempToken` without authentication or verification. This enables any attacker to generate a reset token for arbitrary users and directly reset their password, leading to a complete account takeover (ATO). This vulnerability applies to both the cloud service (`cloud.flowiseai.com`) and self-hosted/local Flowise deployments that expose the same API. Commit 9e178d68873eb876073846433a596590d3d9c863 in version 3.0.6 secures password reset endpoints. Several recommended remediation steps are available. Do not return reset tokens or sensitive account details in API responses. Tokens must only be delivered securely via the registered email channel. Ensure `forgot-password` responds with a generic success message regardless of input, to avoid user enumeration. Require strong validation of the `tempToken` (e.g., single-use, short expiry, tied to request origin, validated against email delivery). Apply the same fixes to both cloud and self-hosted/local deployments. Log and monitor password reset requests for suspicious activity. Consider multi-factor verification for sensitive accounts.
The record classifies CVE-2025-58434 under weakness class CWE-306. Its CVSS v3 base vector states that the flaw is reachable remotely over the network, needs no prior authentication, needs no user interaction, and has high impact on confidentiality, integrity, availability. 1 affected-product entry is recorded, across 1 vendor, listed below. The identifier was first published 420 days ago.
Severity and exploitation probability
- CVSS v3.1 base score
- 9.8 — CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS (FIRST)
- 82.5% probability of exploitation in the next 30 days, higher than 99.6% of all scored CVEs
- CISA KEV
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Threadlinqs priority
- 10/10 — a Threadlinqs composite of the CVSS base score, the EPSS percentile and public exploit availability
- Published
- 2025-09-12, last modified 2025-09-15
Is CVE-2025-58434 being exploited?
Weaponised exploit code for CVE-2025-58434 is publicly available. 11 public proof-of-concept repositories are tracked for this identifier. A ProjectDiscovery Nuclei detection template exists (http/cves/2025/CVE-2025-58434.yaml). It currently carries a trending score of 5 in the Threadlinqs vulnerability feed.
- kartik2005221/CVE-2025-58434-AND-59528-POC (github)
- AzureADTrent/CVE-2025-58434-59528 (github)
- jwsly12/CVE-2025-58434-59528-htb-ctf (github)
- CVETeam/FlowiseAI-Critical-KillChain (github)
- kartik2005221/CVE-2025-58434-poc (github)
- arensballiu/Flowise-CVE-2025-58434-PasswordReset (github)
- SteamPunk424/CVE-2025-58434-Unauthenticated-Password-Reset-Flowwise (github)
- 0xDaeras/Flowise-CVE-2025-58434-Chain-59528 (github)
Affected products and versions
- FlowiseAI: Flowise
How to fix CVE-2025-58434
The record marks a vendor fix as available for CVE-2025-58434. Patch reference: https://github.com/FlowiseAI/Flowise/commit/9e178d68873eb876073846433a596590d3d9c863. Vendor advisory: https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-wgpv-6j63-x5ph. Apply the vendor fix referenced above to every affected product listed in this record, then confirm the running version against the vendor advisory.
Threat activity tracking CVE-2025-58434
1 tracked threat in the Threadlinqs corpus references CVE-2025-58434, either in the campaign’s CVE list or as an indicator on the campaign record.
Sources
Enriched from CVE.org, NVD, FIRST EPSS, public proof-of-concept repositories, ProjectDiscovery Nuclei. Last verified by Threadlinqs on . This product uses the NVD API but is not endorsed or certified by the NVD.