This leak occurs because the application fails to adequately sanitize the response or restrict sensitive information when the request is processed. Because the tempToken is returned directly to the requester, an attacker can bypass the intended password reset workflow, which should require access to the user's email inbox. This enables full, unauthenticated account takeover of any user within the target Flowise instance. The vulnerability has a CVSS v3.1 score of 9.8, and multiple functional proof-of-concept exploits have been published publicly, significantly lowering the barrier for exploitation.

Attack Chain

1. The attacker performs reconnaissance to identify a Flowise instance reachable over the network.
2. The attacker selects a target email address associated with an account on the target Flowise instance.
3. The attacker sends an HTTP POST request to the /api/v1/account/forgot-password endpoint with the target's email address.
4. The Flowise server processes the request and generates a tempToken for the password reset.
5. The server returns a 200 OK response containing the tempToken in the response body.
6. The attacker extracts the tempToken from the response.
7. The attacker uses the extracted tempToken to interact with the password reset completion endpoint to set a new password.
8. The attacker gains full control over the compromised account.

Impact

Successful exploitation allows unauthenticated attackers to perform a full account takeover of any user in the Flowise instance. This results in the loss of confidentiality and integrity of all workflows, credentials, and data accessible to that user account. Given the nature of Flowise, this likely includes exposure of API keys, sensitive data processing logs, and control over downstream automated workflows.

Recommendation

• Immediately upgrade all Flowise instances to version 3.0.6 or later to mitigate CVE-2025-58434.
• Audit access logs for anomalous POST requests to the /api/v1/account/forgot-password endpoint.
• Monitor web server logs for high volumes of password reset requests from single source IPs, which may indicate automated scanning or exploitation attempts.
• Deploy the provided detection rule to identify and block potential exploitation attempts targeting this endpoint.