FlowiseAI Flowise before version 3.1.0 contains an improper authentication vulnerability (CWE-287) in its password reset functionality. Specifically, the resetPassword method does not check if a valid reset token was issued before allowing a password reset. Since the default reset token value is null or empty, an attacker can exploit this by submitting a reset request with a null or empty token for any known user email, effectively bypassing authentication and resetting the user's password. This critical flaw enables unauthorized account takeover. The issue is resolved in Flowise version 3.1.0.

An attacker can reset any user's password without authentication by exploiting the lack of reset token validation. This leads to unauthorized account access and potential full compromise of user accounts on affected Flowise installations prior to version 3.1.0. The vulnerability has a CVSS 4.0 score of 7.7 (high severity), indicating significant risk if exploited.

Upgrade Flowise to version 3.1.0 or later where this vulnerability is fixed. No other official remediation or temporary fixes are documented. Until patched, restrict access to the password reset API endpoint or implement additional access controls to prevent unauthorized password resets.