Vulnerability · Published Jun 25, 2026 · Assigned by VulnCheck
CVE-2025-71327Flowise - Authentication Bypass via Unprotected Registration Endpoint
Critical 9.1
In plain English
A critical-severity missing authentication in Flowise from Flowise. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities).
Severity (CVSS 3.1)9.1Critical
Exploit odds (30 days)0.7%top 47.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Flowise contains an authentication bypass vulnerability in the unprotected /api/v1/account/register endpoint that allows unauthenticated attackers to create user accounts. Remote attackers can exploit this endpoint to register arbitrary accounts and authenticate to the system, gaining full API access without credentials.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | flowise | no fix listed | GHSA-v5w9-prxf-w882 |
Affected products (as reported)
Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
References
- GitHub Security Advisory (GHSA-v5w9-prxf-w882) vendor-advisory
- VulnCheck Advisory: Flowise - Authentication Bypass via Unprotected Registration Endpoint third-party-advisory