CVE-2025-71327: Flowise Authentication Bypass Grants Full API Access

Executive Summary

CVE-2025-71327 is a critical authentication bypass vulnerability (CVSS 9.1) in Flowise, the open-source platform for building LLM-powered workflows and chatbots. The /api/v1/account/register endpoint is left completely unprotected, allowing unauthenticated remote attackers to register arbitrary user accounts and gain full API access to the Flowise instance — including access to credentials, AI models, workflows, and data pipelines.

Vulnerability Details

Root Cause

Flowise implements authentication middleware to protect its API routes. However, the /api/v1/account/register endpoint was not included in the protected route set. An unauthenticated attacker can send a POST request to this endpoint to create an arbitrary user account:

POST /api/v1/account/register HTTP/1.1
Host: flowise.target.com
Content-Type: application/json
 
{
  "username": "attacker",
  "password": "AttackerPass123!",
  "email": "attacker@evil.com"
}

Once registered, the attacker authenticates normally and gains complete access to the Flowise API — equivalent to a legitimate administrator or user depending on the role assigned at registration.

What Attackers Can Access

After bypassing authentication, a threat actor gains access to everything a legitimate Flowise user can reach:

Severity Amplification: AI Platform Context

The severity is compounded by Flowise's role as an AI orchestration platform. A compromised Flowise instance can expose:

• LLM API keys — Anthropic, OpenAI, Azure credentials stored in the credential vault
• Prompt injection vectors — Modify system prompts in production chatbots
• Data pipeline access — Documents, PDFs, and databases loaded into vector stores
• Webhook endpoints — Trigger external API calls and automations

Affected Versions

All Flowise versions where authentication is enabled but the registration endpoint bypass is unpatched are affected. Self-hosted Flowise deployments configured with user authentication are the primary risk surface. Cloud-hosted instances (e.g., Flowise Cloud) should be verified with the vendor.

Check your Flowise version:

# Check Flowise version
docker exec <flowise-container> npm list flowise 2>/dev/null | grep flowise
 
# Or check the package.json inside the container
docker exec <flowise-container> cat /usr/src/packages/server/package.json | grep '"version"'

Immediate Remediation

Patch

1. Update Flowise immediately to the latest patched release via the official GitHub repository or Docker Hub
2. Restart the Flowise service after applying the update
3. Audit registered accounts — check for unknown accounts created before patching

# Pull latest patched Flowise Docker image
docker pull flowiseai/flowise:latest
docker-compose up -d --force-recreate flowise

Interim Mitigation (If Patching Is Delayed)

Block the registration endpoint via reverse proxy while preparing the patch:

# Nginx — block unauthenticated access to registration endpoint
location /api/v1/account/register {
    # Allow only internal networks or trusted IPs
    allow 10.0.0.0/8;
    deny all;
}

# Or disable registration entirely in Flowise environment config
FLOWISE_DISABLE_REGISTRATION=true

Post-Patch Audit

1. Review all registered user accounts for unexpected entries
2. Rotate all API keys stored in the Flowise credential vault (OpenAI, Anthropic, database credentials, webhooks)
3. Review LLM workflow configurations for unauthorized modifications
4. Check chat history logs for attacker reconnaissance activity
5. Audit external tool integrations for unauthorized webhook calls

Detection

Signs of Active Exploitation

Log Query

# Search Flowise logs for registration endpoint hits
docker logs flowise 2>&1 | grep "account/register"
 
# Or check nginx/traefik access logs
grep "POST /api/v1/account/register" /var/log/nginx/access.log

Why This Matters for AI Infrastructure

Flowise is widely deployed for building internal AI assistants, customer-facing chatbots, and LLM-powered automation pipelines. A compromise of a Flowise instance represents a multi-vector attack surface:

1. Credential harvest — All stored API keys and service credentials are exposed
2. Supply chain risk — Modified chatbots can be weaponized to attack end users
3. Data exfiltration — Vector store contents (embedded documents, knowledge bases) can be extracted
4. Lateral movement — Tool integrations may expose internal network services

Organizations building AI workflows on Flowise should treat this as a priority patch — the unprotected registration endpoint is trivially exploitable with a single HTTP request.

Key Takeaways

1. CVSS 9.1 Critical — No authentication required to register accounts and gain full API access
2. Single HTTP request exploit — Trivial to exploit with no tooling required
3. AI credential exposure — LLM API keys (OpenAI, Anthropic, Azure) stored in credential vault are at risk
4. Patch immediately — Update to the latest Flowise release and restart
5. Rotate all credentials stored in Flowise after patching, regardless of confirmed exploitation

References

• NVD — CVE-2025-71327
• Flowise GitHub Repository
• Flowise Docker Hub
• OWASP — Broken Access Control (A01)