Flowise has Authentication Bypass Using Unprotected Registration Endpoint (/register)
HighCVE-2025-71327 · Published Nov 17, 2025 · updated Jul 8, 2026
### Summary An unauthenticated attacker can exploit the unprotected registration endpoint (/register) to create a new user and bypass authentication. ### Details Critical vulnerability in Flowise 3.0.1 on-premise deployment allows unauthenticated attackers to exploit the /api/v1/account/register endpoint to add a new user and log in using it, enabling authentication bypass. Meaning that the register functionality is by default open, allowing attackers to create an account and use the api without any restrictions or credentials. ### PoC A Flowise 3.0.1 instance was deployed via Docker for the purpose of this demonstration.  After successful deployment the instance setup organization page allows us to register the first account in the system.  Creating the first user [research@evasec.io](mailto:research@evasec.io)  Login to the account  to create a new user and bypass authentication. ### Details Critical vulnerability in Flowise 3.0.1 on-premise deployment allows unauthenticated attackers to exploit the /api/v1/account/register endpoint to add a new user and log in using it, enabling authentication bypass. Meaning that the register functionality is by default open, allowing attackers to create an account and use the api without any restrictions or credentials. ### PoC A Flowise 3.0.1 instance was deployed via Docker for the purpose of this demonstration.  After successful deployment the instance setup organization page allows us to register the first account in the system.  Creating the first user [research@evasec.io](mailto:research@evasec.io)  Login to the account  The background request that created the first user to /api/v1/account/register  Response  We have found that it is possible to reuse the registration request multiple times without any restrictions to create an account and authenticate to the system using it. Crafting a new request { "user": { "name": "Malicious", "email": "attacker@attack.io", "type": "pro", "credential": "Password123!" } }  Response with 201 code “Created”  Login using newly created user (attacker)  Success login  An unauthorized user can exploit this vulnerability to register an account and gain access to the Flowise API with authenticated privileges, effectively bypassing authentication. ### Impact This is an authentication bypass vulnerability caused by an unprotected registration endpoint (/register). Users of Flowise 3.0.1(latest) on-premise deployments are impacted. An unauthorized attacker can exploit this vulnerability to register an account after the organization set has been completed, and gain access to the Flowise API with authenticated privileges, effectively bypassing authentication.
- CVSS 4.0
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-287
- Also known as
- CVE-2025-71327
More Flowise advisories
All Flowise| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Nov 142025 | Flowise Fails to Invalidate Existing Sessions After Password Changes High8.1Nov 14, 2025 | High8.1 | 3.0.10 |
| Oct 142025 | Flowise: Authenticated Command Execution and Sandbox Bypass via Puppeteer and Playwright PackagesHighOct 14, 2025 | High | 3.0.8 |
| Oct 102025 | Flowise is vulnerable to arbitrary file exposure through its ReadFileToolHigh7.7Oct 10, 2025 | High7.7 | 3.0.8 |
| Oct 92025 | Flowise is vulnerable to arbitrary file write through its WriteFileToolCritical9.9Oct 9, 2025 | Critical9.9 | 3.0.8 |
| Oct 82025 | FlowiseAI/Flosise has File Upload vulnerabilityHigh8.3Oct 8, 2025 | High8.3 | 3.0.8 |
| Oct 62025 | Flowise vulnerable to RCE via Dynamic function constructor injectionCritical9.8Oct 6, 2025 | Critical9.8 | No fix yet |