CVE-2026-41276: Flowise: Authentication Bypass in AccountService resetPassword
Flowise versions before 3.1.0 contain an authentication bypass in the resetPassword method of the AccountService class. The code does not verify that a password reset token was actually issued, so an unauthenticated remote party who knows a user's email address may be able to reset that user's password. The record reports a fix in 3.1.0 and no confirmed exploitation in the sources consulted.
Overview
Flowise is a drag-and-drop interface for building customized large language model flows. According to the record, a flaw in the resetPassword method of the AccountService class can let an unauthenticated remote party reset a user's password, because the code does not confirm that a reset token was issued. The record states the issue is fixed in 3.1.0.
Impact
- The record describes a full authentication bypass with a critical base score in the NVD.
- An unauthenticated party who knows a target's email address could take over that account (inference from the described reset flow).
- The weakness is classified as CWE-287, Improper Authentication.
Affected products and versions
- Product: Flowiseai Flowise.
- Affected: before 3.1.0.
- Fixed: 3.1.0.
- The fixes list in the record is empty. The fixed version is taken from the description text and the vendor advisory reference.
Exploitation status
- The record shows this CVE is not listed in the CISA KEV catalog, so active exploitation is not confirmed by that source.
- No confirmed exploitation in the wild appears in the sources consulted.
- The SSVC data in the record rates exploitation as proof-of-concept and automatable as no.
- A vendor advisory reference in the record carries an exploit-related tag; this tag does not confirm real-world use.
Remediation and mitigation
- Upgrade Flowise to 3.1.0 or later, as stated in the record.
- Until the upgrade is applied, limit network exposure of Flowise instances, especially from untrusted networks, and restrict access to account management functions where possible.
- After patching, review accounts for password changes that the owners did not request.
Detection guidance
- Review application and web server logs for password reset activity that does not match expected user-initiated flows.
- Look for successful logins shortly after password reset events, particularly from unfamiliar sources.
- Treat unexplained account lockouts or credential changes as potential indicators and investigate them.
Limitations of the available information
- The record does not provide vendor patch notes or a detailed list of builds within the affected range.
- No independent technical validation was available in the sources consulted.
- The record's EPSS entry carries a date that should be checked against the current data source before use.
- Whether other forks, deployments or configurations are affected is unknown from the record.
Frequently asked questions
Which Flowise versions are affected by this CVE?
According to the record, versions before 3.1.0 are affected, and the issue is fixed in 3.1.0.
Does exploitation require authentication?
No. The record states that authentication is not required to exploit this vulnerability.
Is this CVE known to be exploited in the wild?
The record shows it is not listed in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.
What should administrators do first?
Upgrade Flowise to 3.1.0 or later, limit network exposure of affected instances, and review accounts for unexpected password changes.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.