The flaw resides in the resetPassword method of the Flowise AccountService. The method does not verify that a valid password reset token exists before allowing a password change. An attacker who knows a user’s email address can submit a request to the /api/v1/account/reset-password endpoint with a null or empty token, causing the user’s password to be reset to a value chosen by the attacker.

Affected systems are installations of FlowiseAI Flowise prior to version 3.1.0. The vulnerability applies to all users whose accounts have not yet received a password reset token, which is the default state, and to accounts that have reset their password before, as the stored token becomes an empty string. No specific sub‑versions are listed; any release before the 3.1.0 patch set.

The CVSS score of 7.7 reflects a moderate to severe risk, and the EPSS score of 7% indicates a somewhat higher probability of exploitation compared to earlier assessment. The vulnerability is not yet in CISA’s KEV catalog. Exploitation requires only the target’s email address. An attacker can send a request with a null or empty token to the /api/v1/account/reset-password endpoint to reset the password, after which they can log in as that user.