Flowise's checkBasicAuth endpoint validates credentials in plaintext using direct comparison without cryptographic safeguards. The absence of rate limiting and the straightforward comparison logic enable an attacker to immediately retrieve or brute‑force authentication credentials. This exposes user accounts and any privileges tied to those accounts, allowing unauthorized access to Flowise’s web interface and underlying services.

Vendors affected include FlowiseAI’s Flowise product. Any installation running a version prior to 3.1.2 is vulnerable. The issue was publicly identified in the release notes for versions before Flowise 3.1.2.

The CVSS score of 9.1 indicates a critical severity vulnerability. The EPSS score is 0.00041, indicating a very low probability of exploitation, and Flowise is not listed in the CISA KEV catalog. The likely attack vector is a network‑accessible API endpoint that accepts Basic Authentication, which can be exploited from the Internet or internal networks if firewall rules are permissive. Given the lack of rate limiting, attackers can quickly enumerate or brute‑force credentials, increasing the potential for widespread credential compromise.