CVE-2025-71327: Flowise - Authentication Bypass via Unprotected Registration Endpoint

Severity: critical (CVSS 9.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-06-25 · updated 2026-10-12
Weakness: CWE-306

Description

Flowise contains an authentication bypass vulnerability in the unprotected /api/v1/account/register endpoint that allows unauthenticated attackers to create user accounts. Remote attackers can exploit this endpoint to register arbitrary accounts and authenticate to the system, gaining full API access without credentials.

Affected products

FlowiseAI Flowise: 3.0.1

References

https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-v5w9-prxf-w882
https://www.vulncheck.com/advisories/flowise-authentication-bypass-via-unprotected-registration-endpoint
https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-v5w9-prxf-w882

Get alerted when CVE-2025-71327 or the next vulnerability affects your stack