HighVulnerability
GHSA-x5w6-38gp-mrqh: Flowise: Password Reset Link Sent Over Unsecured HTTP
- Identifier
- GHSA-x5w6-38gp-mrqh
- Published
- Record updated
- Affected
- flowise <= 3.0.13
- Fixed in
- 3.1.0
Summary
The password reset functionality on cloud.flowiseai.com sends reset password links over unsecured HTTP instead of HTTPS. An attacker on the same network as the victim, such as on public Wi-Fi, can intercept the link and capture the reset token, enabling hijack of the password reset session and potential account compromise.
Mitigation
Ensure all sensitive URLs, especially password reset links, are generated and transmitted over secure https:// endpoints only. Use HTTPS in all password-related email links. Implement HSTS (HTTP Strict Transport Security) to enforce secure connections.
Affected packages in the Exposure Registry
Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.
- flowisenpmLLM dependency since 2024-03-12
Related items
- MediumRansomware extortion gets personal as attackers target employees’ familiesSimilar attack · CSO Online
- MediumLangflow's Critical Authenticated RCE Flaw Targeted in 1,423 Honeypot Exploit AttemptsSimilar attack · The Hacker News
- MediumAnthropic 'SneakPeek' Flaw Is a Silent Zero-Click ThreatSimilar attack · Dark Reading
- HighCVE-2026-104103: Ludwig archive extraction allows writes outside extraction directorySimilar attack · NVD/CVE Database
- InfoFrom Training to Escalation: Forensic Analysis and Local Recreation of RL/RLHF-Induced Privilege Escalation in AI Agents (CVE-2026-65616)Similar attack · Arxiv (cs.CR + cs.CL + cs.LG)