Description
Flowise是一个基于Node.js的AI工作流编排平台，用于构建和部署AI应用。其/api/v1/account/forgot-password端点存在设计缺陷，未经验证即返回包含密码重置令牌的敏感信息。攻击者仅需知道目标邮箱地址即可获取有效重置令牌，进而完全接管任意账户（包括管理员账户）。该漏洞影响Flowise云服务及所有自托管实例，可导致核心业务系统被完全控制，建议企业立即升级至修复版本。
Flowise /api/v1/account/forgot-password 未授权访问漏洞（CVE-2025-58434）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2025-58434
https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-wgpv-6j63-x5ph
https://blog.csdn.net/seoppg/article/details/152223785
https://www.sentinelone.com/vulnerability-database/cve-2025-58434/
https://www.ionix.io/threat-center/cve-2025-58434/
https://security.snyk.io/vuln/SNYK-JS-FLOWISE-12743574
https://access.redhat.com/security/cve/cve-2025-58434
https://osv.dev/vulnerability/CVE-2025-58434
https://www.ameeba.com/blog/cve-2025-58434-unauthenticated-password-reset-exploit-in-flowise/