VULNERABILITY INTELLIGENCE

CVE-2025-71327

CVSS score9.3 CRITICAL
EPSS probability0.68%
CISA KEVNot currently listed
Published2026-06-25
Last modified2026-10-12
CVSS vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Description

Flowise contains an authentication bypass vulnerability in the unprotected /api/v1/account/register endpoint that allows unauthenticated attackers to create user accounts. Remote attackers can exploit this endpoint to register arbitrary accounts and authenticate to the system, gaining full API access without credentials.

Weakness classification

  • CWE-306: Missing Authentication for Critical Function

Primary references