The vulnerability resides in the Login function of FlowiseAI Flowise’s account.service.ts, allowing an attacker to abuse the API response handler and inadvertently disclose authentication data. By manipulating the login request, sensitive information such as credentials can be leaked through the API’s response. The flaw is not an execution flaw but leads to accidental data exposure that could be leveraged for further attacks.

The flaw affects FlowiseAI Flowise deployments up to version 3.0.12. Any installation of the Flowise platform using a version equal to or older than 3.0.12 is susceptible, regardless of environment, as the issue is embedded in the core Flowise API code.

The CVSS base score is 6.3, indicating a moderate severity, and the EPSS score is < 1%, indicating a low probability of active exploitation. The attack vector is remote, requiring high complexity and is considered difficult to exploit. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The likely attack path involves sending crafted requests to the login endpoint which triggers the API to reveal extraneous authentication details, a scenario inferred from the description.