GHSA-V5W9-PRXF-W882
Vulnerability from github – Published: 2025-11-17 19:06 – Updated: 2025-11-17 19:06Summary
An unauthenticated attacker can exploit the unprotected registration endpoint (/register) to create a new user and bypass authentication.
Details
Critical vulnerability in Flowise 3.0.1 on-premise deployment allows unauthenticated attackers to exploit the /api/v1/account/register endpoint to add a new user and log in using it, enabling authentication bypass.
Meaning that the register functionality is by default open, allowing attackers to create an account and use the api without any restrictions or credentials.
PoC
A Flowise 3.0.1 instance was deployed via Docker for the purpose of this demonstration.
After successful deployment the instance setup organization page allows us to register the first account in the system.
Creating the first user research@evasec.io
Login to the account
The background request that created the first user to /api/v1/account/register
Response
We have found that it is possible to reuse the registration request multiple times without any restrictions to create an account and authenticate to the system using it.
Crafting a new request
{
"user": {
"name": "Malicious",
"email": "attacker@attack.io",
"type": "pro",
"credential": "Password123!"
}
}
Response with 201 code “Created”
Login using newly created user (attacker)
Success login
An unauthorized user can exploit this vulnerability to register an account and gain access to the Flowise API with authenticated privileges, effectively bypassing authentication.
Impact
This is an authentication bypass vulnerability caused by an unprotected registration endpoint (/register).
Users of Flowise 3.0.1(latest) on-premise deployments are impacted. An unauthorized attacker can exploit this vulnerability to register an account after the organization set has been completed, and gain access to the Flowise API with authenticated privileges, effectively bypassing authentication.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "flowise"
},
"versions": [
"3.0.1"
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-287"
],
"github_reviewed": true,
"github_reviewed_at": "2025-11-17T19:06:09Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "### Summary\nAn unauthenticated attacker can exploit the unprotected registration endpoint (/register) to create a new user and bypass authentication.\n### Details\nCritical vulnerability in Flowise 3.0.1 on-premise deployment allows unauthenticated attackers to exploit the /api/v1/account/register endpoint to add a new user and log in using it, enabling authentication bypass.\n\nMeaning that the register functionality is by default open, allowing attackers to create an account and use the api without any restrictions or credentials.\n\n### PoC\nA Flowise 3.0.1 instance was deployed via Docker for the purpose of this demonstration.\n\n\nAfter successful deployment the instance setup organization page allows us to register the first account in the system.\n\n\nCreating the first user [research@evasec.io](mailto:research@evasec.io)\n\n\nLogin to the account\n\n\nThe background request that created the first user to /api/v1/account/register \n\n\nResponse\n\n\nWe have found that it is possible to reuse the registration request multiple times without any restrictions to create an account and authenticate to the system using it.\n\nCrafting a new request \n{\n \"user\": {\n \"name\": \"Malicious\",\n \"email\": \"attacker@attack.io\", \n \"type\": \"pro\",\n \"credential\": \"Password123!\"\n }\n}\n\n\nResponse with 201 code \u201cCreated\u201d\n\n\nLogin using newly created user (attacker)\n\n\nSuccess login\n\n\n\nAn unauthorized user can exploit this vulnerability to register an account and gain access to the Flowise API with authenticated privileges, effectively bypassing authentication. \n### Impact\n\nThis is an authentication bypass vulnerability caused by an unprotected registration endpoint (/register).\n\nUsers of Flowise 3.0.1(latest) on-premise deployments are impacted. An unauthorized attacker can exploit this vulnerability to register an account after the organization set has been completed, and gain access to the Flowise API with authenticated privileges, effectively bypassing authentication.",
"id": "GHSA-v5w9-prxf-w882",
"modified": "2025-11-17T19:06:09Z",
"published": "2025-11-17T19:06:09Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-v5w9-prxf-w882"
},
{
"type": "PACKAGE",
"url": "https://github.com/FlowiseAI/Flowise"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Flowise has Authentication Bypass Using Unprotected Registration Endpoint (/register)"
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.