Advisory Details

April 27th, 2026

Flowise AccountService resetPassword Authentication Bypass Vulnerability

CVE ID	CVE-2026-41276
CVSS SCORE	8.1, AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
AFFECTED VENDORS	Flowise
AFFECTED PRODUCTS	Flowise
VULNERABILITY DETAILS	This vulnerability allows remote attackers to bypass authentication on affected installations of Flowise. Authentication is not required to exploit this vulnerability. The specific flaw exists within the resetPassword method of the AccountService class. The issue results from improper implementation of the password reset mechanism. An attacker can leverage this vulnerability to bypass authentication on the system.
ADDITIONAL DETAILS	Flowise has issued an update to correct this vulnerability. More details can be found at: https://github.com/FlowiseAI/Flowise/commit/6c78e1c36f4cf08874b9b7a444d61ab63441d78a
DISCLOSURE TIMELINE	2026-02-19 - Vulnerability reported to vendor 2026-04-27 - Coordinated public release of advisory 2026-04-27 - Advisory Updated
CREDIT	Nicholas Zubrisky (@NZubrisky) of TrendAI Research

BACK TO ADVISORIES