Flowise: Flowise contains an authentication bypass vulnerability in the unprotected…
Flowise
More for Flowise RSS feed for Flowise
- Severity
- Critical, CVSS 9.1
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- Record
- CVE-2025-71327
- Affects
- Flowise
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- June 25, 2026
- Source last modified
- October 12, 2026
Description
Flowise contains an authentication bypass vulnerability in the unprotected /api/v1/account/register endpoint that allows unauthenticated attackers to create user accounts. Remote attackers can exploit this endpoint to register arbitrary accounts and authenticate to the system, gaining full API access without credentials.
Description quoted from the NVD record.
Who is affected
Flowise is a tool for building apps that use AI language models. This flaw affects Flowise, and no specific affected versions are named for it. The problem is in the part of the product that lets people sign up for a new user account, which is left open without any login check. An attacker on the internet, with no password, could use it to create their own account, sign in, and then get full access to the product's programming interface (the way other software controls Flowise). This flaw is rated Critical.
What to do
- If you or someone on your staff installed and runs Flowise, that person should handle this.
- If an IT provider or vendor runs Flowise for your organization, send them this advisory and ask when the update will be done.
- No fixed version is named for this flaw yet, so check the vendor advisory linked on this page for a fixed release.
- When a fixed release is available, the person who runs Flowise should install it as soon as possible.
Analysis written from the source record as of October 12, 2026 and reviewed before publishing.