FlowiseAI Flowise versions up to 3.0.5 have a missing authentication vulnerability (CWE-306) in the forgot-password endpoint. The endpoint returns a valid password reset temporary token in its response without any authentication or verification, enabling attackers to generate reset tokens for any user and reset their passwords directly. This leads to full account takeover. The vulnerability affects both cloud and self-hosted deployments exposing this API. The issue was fixed in version 3.0.6 by securing the password reset endpoints, ensuring tokens are only delivered securely via registered email, and enforcing strong validation of reset tokens.

An attacker can obtain valid password reset tokens for arbitrary users without authentication, allowing them to reset passwords and take over user accounts completely. This compromises confidentiality, integrity, and availability of user accounts and potentially the entire system depending on account privileges.

A fix is available in Flowise version 3.0.6 that secures the password reset endpoints by removing token exposure in API responses and enforcing secure token delivery via email. Users and administrators should upgrade to version 3.0.6 or later. Additionally, ensure the forgot-password endpoint returns generic success messages to prevent user enumeration, validate reset tokens as single-use with short expiry tied to request origin, and consider multi-factor verification for sensitive accounts. Apply these fixes to both cloud and self-hosted deployments.