CVE-2025-71327Critical· 9.1▾ MidnightFlowise contains an authentication bypass vulnerability in the unprotected /api/v1/account/register endpoint that allows unauthenticated attackers to create user accounts. Remote attackers can exploit this endpoint to register arbitrary …
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 50.1 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 30.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.7%
Last analysed / modified upstream
Flowise contains an authentication bypass vulnerability in the unprotected /api/v1/account/register endpoint that allows unauthenticated attackers to create user accounts. Remote attackers can exploit this endpoint to register arbitrary accounts and authenticate to the system, gaining full API access without credentials.
flowise = 3.0.1Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2025-58434Critical· 9.8Flowise is a drag & drop user interface to build a customized large language model flow
GHSA-w5r9-j49j-2m55Critical· 9.8Duplicate Advisory : Flowise has arbitrary file access due to missing chat flow id validation
GHSA-c3hj-m5hq-59xwCritical· 10.0Duplicate Advisory : Flowise allows arbitrary file write to RCE
GHSA-q2xp-j85q-883hCritical· 9.8Duplicate Advisory: Flowise has unsandboxed remote code execution via Custom MCP
GHSA-6j9g-8fxc-25hqCritical· 8.8Duplicate Advisory: Flowise contains an unauthenticated sandbox escape
GHSA-x3jw-7gj7-qv6mCritical· 9.8Duplicate Advisory: Flowise Prompt Injection to RCE and SSRF via CSV/Airtable Agent Python Validator Bypass