CVE-2025-71327

Flowise contains an authentication bypass vulnerability in the unprotected /api/v1/account/register endpoint that allows unauthenticated attackers to create user accounts. Remote attackers can exploit this endpoint to register arbitrary accounts and authenticate to the system, gaining full API access without credentials.

CVSS v3 9.1 CRITICAL

9.1^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-v5w9-prxf-w882	Exploit Vendor Advisory
https://www.vulncheck.com/advisories/flowise-authentication-bypass-via-unprotected-registration-endpoint	Third Party Advisory
https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-v5w9-prxf-w882	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:flowiseai:flowise:3.0.1:*:*:*:*:*:*:*

History

29 Jun 2026, 18:44

Type	Values Removed	Values Added
First Time		Flowiseai flowise Flowiseai
References	~~() https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-v5w9-prxf-w882 -~~	() https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-v5w9-prxf-w882 - Exploit, Vendor Advisory
References	~~() https://www.vulncheck.com/advisories/flowise-authentication-bypass-via-unprotected-registration-endpoint -~~	() https://www.vulncheck.com/advisories/flowise-authentication-bypass-via-unprotected-registration-endpoint - Third Party Advisory
CPE		cpe:2.3:a:flowiseai:flowise:3.0.1:::::::*

26 Jun 2026, 14:16

Type	Values Removed	Values Added
References	~~() https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-v5w9-prxf-w882 -~~	() https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-v5w9-prxf-w882 -

25 Jun 2026, 22:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-06-25 22:16

Updated : 2026-06-29 18:44

NVD link : CVE-2025-71327

Mitre link : CVE-2025-71327

CVE.ORG link : CVE-2025-71327

JSON object : View

Products Affected

flowiseai

flowise

CWE

CWE-306

Missing Authentication for Critical Function

{"id": "CVE-2025-71327", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-71327", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-06-26T12:46:18.399148Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "Flowise", "product": "Flowise", "versions": [{"status": "affected", "version": "3.0.1", "versionType": "semver"}], "packageURL": "pkg:npm/flowise", "defaultStatus": "unaffected"}]}], "published": "2026-06-25T22:16:58.740", "references": [{"url": "https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-v5w9-prxf-w882", "tags": ["Exploit", "Vendor Advisory"], "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/flowise-authentication-bypass-via-unprotected-registration-endpoint", "tags": ["Third Party Advisory"], "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-v5w9-prxf-w882", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-306"}]}], "descriptions": [{"lang": "en", "value": "Flowise contains an authentication bypass vulnerability in the unprotected /api/v1/account/register endpoint that allows unauthenticated attackers to create user accounts. Remote attackers can exploit this endpoint to register arbitrary accounts and authenticate to the system, gaining full API access without credentials."}], "lastModified": "2026-06-29T18:44:34.753", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:flowiseai:flowise:3.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "50E05577-E358-472D-9273-3EA9DEDEC2D0"}], "operator": "OR"}]}], "sourceIdentifier": "disclosure@vulncheck.com"}