🚨 CRITICAL - Flowise unauthenticated account creation via exposed registration API (CVE-2025-71327) Flowise exposes an unprotected /api/v1/account/register endpoint in its API layer that allows anyone to register new user accounts without prior authentication. The issue stems from missing access control/improper authentication enforcement on the registration route, effectively creating an authentication bypass. An unauthenticated attacker can remotely hit the endpoint over HTTP to create an account, then log in normally and operate as a valid user without any legitimate credentials. If exploited, this results in full API access under attacker-controlled accounts, enabling unauthorized data access and potential takeover of workflows, integrations, and connected resources. 👉 Affected: flowise (version range not specified) | Upgrade to vendor-fixed release (not specified)
Post summary
The post discloses a critical unauthenticated account creation flaw in Flowise (CVE‑2025‑71327), outlines its impact, and recommends upgrading to the vendor‑fixed release, but provides no PoC, exploit code, or evidence of active exploitation.