CVE-2025-71328: Flowise unverified password change

CISO Take

Flowise before 3.0.10 allows any authenticated user to permanently change their account password without supplying the current password, meaning a single hijacked session instantly converts into a full, persistent credential takeover. This is especially damaging in Flowise deployments because accounts store LLM API keys, connected database credentials, and fully-configured AI agent workflows — all handed to an attacker who locks out the legitimate owner. The Flowise npm package has accumulated 112 CVEs, signaling a historically under-secured codebase; while no public exploit exists and the vulnerability is absent from CISA KEV, the trivial post-session exploitation path keeps organizational risk elevated for any team running Flowise as an internal AI orchestration platform. Upgrade to Flowise 3.0.10 immediately, rotate all embedded API keys as a precaution, and enforce session expiration plus MFA to close the hijack surface.

Sources: NVD GitHub Advisory ATLAS vulncheck.com

What is the risk?

CVSS 8.3 (High) with a network-accessible, low-complexity, low-privilege attack vector makes this a credible post-session escalation path with minimal technical barrier. The absence of a public exploit and CISA KEV listing moderates immediate urgency, but Flowise's track record of 112 CVEs and widespread use as an internal AI orchestration tool with embedded cloud credentials elevates organizational risk beyond the raw score. Any misconfigured session management, XSS flaw, or malicious insider can trigger full account takeover with zero specialized knowledge.

How does the attack unfold?

Session Acquisition

Attacker obtains a valid authenticated Flowise session via XSS exploitation, phishing, session fixation, or unauthorized access to a developer workstation.

AML.T0012

Password Replacement

Attacker navigates to Account Settings → Security and submits a new password; the server accepts the change without validating the current password (CWE-620), permanently locking out the legitimate user.

Persistent Account Control

With exclusive account ownership established, the attacker operates freely within the Flowise instance under the victim's identity, with no forensic session gap.

AML.T0106

Credential and Data Exfiltration

Attacker extracts all embedded LLM API keys, connected service credentials, and sensitive data accessible through AI agent configurations and RAG-connected data sources.

AML.T0083

Session Acquisition

Attacker obtains a valid authenticated Flowise session via XSS exploitation, phishing, session fixation, or unauthorized access to a developer workstation.

AML.T0012

Password Replacement

Attacker navigates to Account Settings → Security and submits a new password; the server accepts the change without validating the current password (CWE-620), permanently locking out the legitimate user.

Persistent Account Control

With exclusive account ownership established, the attacker operates freely within the Flowise instance under the victim's identity, with no forensic session gap.

AML.T0106

Credential and Data Exfiltration

Attacker extracts all embedded LLM API keys, connected service credentials, and sensitive data accessible through AI agent configurations and RAG-connected data sources.

AML.T0083

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Flowise	npm	—	No patch

Do you use Flowise? You're affected.

How severe is it?

CVSS 3.1

8.3 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 33% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

○ Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C High

I High

A Low

What should I do?

6 steps

Upgrade to Flowise 3.0.10 or later immediately — this release enforces current-password verification on all credential change requests.
Audit active sessions and force re-authentication for all users on affected versions.
Rotate all LLM API keys (OpenAI, Anthropic, etc.) and connected service credentials stored within Flowise workflows as a precautionary measure.
Enable MFA on any Flowise deployment that supports it, or place Flowise behind an identity-aware proxy with MFA enforcement.
Review server-side logs for unexpected POST requests to the password-change endpoint going back 30 days to detect retroactive exploitation.
Restrict Flowise admin interfaces to trusted network segments via firewall ACLs.

What does CISA's SSVC say?

Decision Attend

Exploitation poc

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Data Extraction Agent Framework AML.T0012 - Valid Accounts AML.T0083 - Credentials from AI Agent Configuration AML.T0106 - Exploitation for Credential Access

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 9 - Risk management system

ISO 42001

A.6.1.3 - Access control to AI systems

NIST AI RMF

GOVERN 1.2 - Policies, processes, procedures, and practices for AI risk management

OWASP LLM Top 10

LLM07 - Insecure Plugin Design

Frequently Asked Questions

What is CVE-2025-71328?

Flowise before 3.0.10 allows any authenticated user to permanently change their account password without supplying the current password, meaning a single hijacked session instantly converts into a full, persistent credential takeover. This is especially damaging in Flowise deployments because accounts store LLM API keys, connected database credentials, and fully-configured AI agent workflows — all handed to an attacker who locks out the legitimate owner. The Flowise npm package has accumulated 112 CVEs, signaling a historically under-secured codebase; while no public exploit exists and the vulnerability is absent from CISA KEV, the trivial post-session exploitation path keeps organizational risk elevated for any team running Flowise as an internal AI orchestration platform. Upgrade to Flowise 3.0.10 immediately, rotate all embedded API keys as a precaution, and enforce session expiration plus MFA to close the hijack surface.

Is CVE-2025-71328 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2025-71328, increasing the risk of exploitation.

How to fix CVE-2025-71328?

1. Upgrade to Flowise 3.0.10 or later immediately — this release enforces current-password verification on all credential change requests. 2. Audit active sessions and force re-authentication for all users on affected versions. 3. Rotate all LLM API keys (OpenAI, Anthropic, etc.) and connected service credentials stored within Flowise workflows as a precautionary measure. 4. Enable MFA on any Flowise deployment that supports it, or place Flowise behind an identity-aware proxy with MFA enforcement. 5. Review server-side logs for unexpected POST requests to the password-change endpoint going back 30 days to detect retroactive exploitation. 6. Restrict Flowise admin interfaces to trusted network segments via firewall ACLs.

What systems are affected by CVE-2025-71328?

This vulnerability affects the following AI/ML architecture patterns: AI agent frameworks, LLM orchestration platforms, RAG pipelines, AI workflow automation.

What is the CVSS score for CVE-2025-71328?

CVE-2025-71328 has a CVSS v3.1 base score of 8.3 (HIGH). The EPSS exploitation probability is 0.40%.

What is the AI security impact?

Affected AI Architectures

AI agent frameworksLLM orchestration platformsRAG pipelinesAI workflow automation

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0083 Credentials from AI Agent Configuration

AML.T0106 Exploitation for Credential Access

Compliance Controls Affected

EU AI Act: Article 9

ISO 42001: A.6.1.3

NIST AI RMF: GOVERN 1.2

OWASP LLM Top 10: LLM07

What are the technical details?

Original Advisory

Flowise before 3.0.10 contains an unverified password change vulnerability. An authenticated user can change their account password through the account settings (Security) section without supplying the current password or any additional verification, as the application does not enforce a current-password check on the credential change. This can lead to full account takeover, particularly if an attacker can hijack or coerce an authenticated session.

Exploitation Scenario

An attacker compromises a developer's browser session via XSS in a third-party Flowise integration or via a phishing link that steals the session cookie. With the authenticated session, the attacker navigates to Account Settings → Security and submits a new password — no current-password field is required or validated server-side. The legitimate user is immediately locked out. The attacker now holds persistent, exclusive access to all AI agent workflows, extracts stored OpenAI and Anthropic API keys, clones production agent configurations, and exfiltrates customer data from connected RAG databases or vector stores — all operating under the identity of the compromised developer account with zero forensic disruption.

Weaknesses (CWE)

CWE-620 Unverified Password Change Primary CWE-620 Unverified Password Change

CWE-620 — Unverified Password Change: When setting a new password for a user, the product does not require knowledge of the original password, or using another form of authentication.

[Architecture and Design] When prompting for a password change, force the user to provide the original password in addition to the new password.
[Architecture and Design] Do not use "forgotten password" functionality. But if you must, ensure that you are only providing information to the actual user, e.g. by using an email address or challenge question that the legitimate user already provided in the past; do not allow the current user to change this identity information until the correct password has been provided.

Source: MITRE CWE corpus.