The vulnerability in IBM Langflow OSS versions 1.0.0 through 1.10.0 allows an attacker to overwrite the administrator email and exploit the server as an outbound email relay due to an unauthenticated registration POST endpoint. By sending a crafted POST request to the registration URL, a remote attacker can change the stored admin email address to any value, thereby hijacking administrative notifications and potentially compromising account recovery processes. This also enables the application to become a source of spam or phishing emails, increasing the risk of the host being blacklisted and exposing legitimate users.

IBM Langflow OSS, affected versions 1.0.0 to 1.10.0 inclusive. Upgrade to 1.10.1 or later to remove the authentication bypass.

The defect scores a CVSS of 7.5, indicating a high risk to confidentiality, integrity, and availability. The EPSS score is unavailable, and the vulnerability is not listed in the CISA KEV catalog, but the lack of authentication for the endpoint means a remote attacker can exploit it at no cost. An attacker can directly send POST requests without credentials, overwrite admin data, and use the SMTP configuration to relay messages, making exploitation trivial and effective.