CVE-2025-71327

CRITICAL

Flowise contains an authentication bypass vulnerability in the unprotected /api/v1/account/register endpoint that allows unauthenticated attackers to create user accounts. Remote attackers can exploit this endpoint to register arbitrary accounts and authenticate to the system, gaining full API access without credentials.

CVSS v3.1 Score

9.1
CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack Vector
NETWORK
Complexity
LOW
Privileges
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
NONE
Published: 6/25/2026Modified: 6/29/2026

Related Intelligence (1)

CRITICALVulnerability

NVD CRITICAL: CVE-2025-71327 — Flowise contains an authentication bypass vulnerability in the unprotected /api/...

Flowise contains an authentication bypass vulnerability in the unprotected /api/v1/account/register endpoint that allows unauthenticated attackers to create user accounts. Remote attackers can exploit this endpoint to register arbitrary accounts and authenticate to the system, gaining full API access without credentials.

CVE-2025-71327
NIST NVD

References (3)

https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-v5w9-prxf-w882ExploitVendor Advisoryhttps://www.vulncheck.com/advisories/flowise-authentication-bypass-via-unprotected-registration-endpointThird Party Advisoryhttps://github.com/FlowiseAI/Flowise/security/advisories/GHSA-v5w9-prxf-w882ExploitVendor Advisory