Agentflow developed by Flowring contains an authentication bypass flaw that allows unauthenticated remote attackers to obtain an arbitrary user authentication token and log into the system as any user. The weakness is a classic authorization bypass (CWE‑288) with severe implications for confidentiality, integrity, and overall system control.

The affected product is Flowring Agentflow. No specific version information is provided, so any installation of this product remains potentially vulnerable.

The CVSS score of 9.3 places this flaw in the critical range, indicating that exploitation would grant full system access. The EPSS score of less than 1% shows that current exploitation probability is low, but the high severity and absence of a KEV listing suggest that organizations should still act with high caution. The likely attack vector involves the web or API interface that permits retrieval of authentication tokens, enabling unauthenticated remote exploitation.