CVE-2026-41276: Flowise authentication bypass in password reset

Summary

CVE-2026-41276 affects Flowise versions prior to 3.1.0, a drag-and-drop interface for building customized large language model flows. Remote attackers can bypass authentication without credentials by sending a null or empty reset token to the /api/v1/account/reset-password endpoint, provided they know the victim's email address. The resetPassword method of the AccountService class fails to verify that a reset token was actually generated, letting the attacker set the user's password to any value.

Mitigation

This vulnerability is fixed in 3.1.0.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• flowisenpmLLM dependency since 2024-03-12

Related items

• HighCVE-2026-97677: IBM Langflow OSS arbitrary file write and read by authenticated flow authorsSimilar attack · NVD/CVE Database
• MediumRecent AI agent experiments reveal a risky future of machine 'teamwork' inside corporationsSimilar attack · CNBC Technology
• MediumClaude Code's “Don't Ask Again” File Exposes Passwords and Keys in 1,122 Public Copies on GitHubSimilar attack · The Hacker News
• MediumCVE-2026-118046: JS Help Desk plugin stored DOM-based cross-site scripting via jsticket_messageSimilar attack · NVD/CVE Database
• MediumARTEX abuse expands as cybercriminals target financial sectorSimilar attack · Microsoft Security Blog