Vulnerability · Published Oct 17, 2025 · Assigned by twcert
CVE-2025-11899Flowring Technology｜Agentflow - Use of Hard-coded Cryptographic Key
High 8.1
In plain English
A high-severity security flaw in Agentflow from Flowring Technology. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities).
Severity (CVSS 3.1)8.1High
Exploit odds (30 days)0.7%top 47.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Agentflow developed by Flowring has an Use of Hard-coded Cryptographic Key vulnerability, allowing unauthenticated remote attackers to exploit the fixed key to generate verification information, thereby logging into the system as any user. Attacker must first obtain an user ID in order to exploit this vulnerability.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Flowring Technology | Agentflow | 4.0 |
Weakness: CWE-321 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://www.twcert.org.tw/tw/cp-132-10438-1173e-1.html third-party-advisory
- https://www.twcert.org.tw/en/cp-139-10439-0bd15-2.html third-party-advisory