This vulnerability (CVE-2026-41276) affects FlowiseAI Flowise versions before 3.1.0 and is categorized as CWE-287 (Improper Authentication). The flaw exists in the resetPassword method of the AccountService class, where the application does not verify the presence or validity of a password reset token before permitting a password reset. Consequently, an unauthenticated remote attacker who knows a user's email address can bypass authentication controls by submitting a password reset request with a null or empty token, allowing them to reset the user's password arbitrarily. The issue is resolved in Flowise version 3.1.0.

The vulnerability allows unauthenticated remote attackers to reset any user's password without possessing a valid reset token. This can lead to unauthorized account takeover, compromising user accounts and potentially exposing sensitive data or functionality tied to those accounts. The CVSS 4.0 score is 7.7 (high severity), reflecting the network attack vector, required user interaction, and high impact on confidentiality, integrity, and availability.

A fix is available in Flowise version 3.1.0. Users and administrators should upgrade to version 3.1.0 or later to remediate this vulnerability. Since the vendor advisory does not indicate any temporary or alternative mitigations, applying the official update is the recommended course of action.