What’s Vulnerable › Vulnerabilities

CVE-2025-11899: Flowring Technology｜Agentflow - Use of Hard-coded Cryptographic Key

• Severity: high (CVSS 8.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-10-17 · updated 2026-10-09
• Weakness: CWE-321

Description

Agentflow developed by Flowring has an Use of Hard-coded Cryptographic Key vulnerability, allowing unauthenticated remote attackers to exploit the fixed key to generate verification information, thereby logging into the system as any user. Attacker must first obtain an user ID in order to exploit this vulnerability.

Affected products

• FLOWRING Agentflow BPM: 4.0

References

• https://www.twcert.org.tw/en/cp-139-10439-0bd15-2.html
• https://www.twcert.org.tw/tw/cp-132-10438-1173e-1.html

Get alerted when CVE-2025-11899 or the next vulnerability affects your stack