The flaw resides in the resetPassword method of the Flowise AccountService. The method does not verify that a valid password reset token exists before allowing a password change. An attacker who knows a user’s email address can submit a request to the /api/v1/account/reset-password endpoint with a null or empty token, causing the user’s password to be reset to a value chosen by the attacker.

Affected systems are installations of FlowiseAI Flowise prior to version 3.1.0. The vulnerability applies to all users whose accounts have not yet received a password reset token, which is the default state, and to accounts that have reset their password before, as the stored token becomes an empty string. No specific sub‑versions are listed; any release before the 3.1.0 patch set.

The CVSS score of 7.7 reflects a moderate to severe risk, while the EPSS score of less than 1% indicates a low probability of exploitation at present. The vulnerability is not yet in CISA’s KEV catalog. Exploitation requires only the target’s email address and the public exposure of the reset endpoint, both commonly available in a typical deployment. An attacker can perform a simple HTTP request to reset the password, after which they can log in as that user.