CVE-2025-11899: Flowring Technology｜Agentflow - Use of Hard-coded Cryptographic Key
Agentflow developed by Flowring has an Use of Hard-coded Cryptographic Key vulnerability, allowing unauthenticated remote attackers to exploit the fixed key to generate verification information, thereby logging into the system as any user. Attacker must first obtain an user ID in order to exploit this vulnerability.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2025-11899?
CVE-2025-11899 is considered a high severity vulnerability due to its potential for unauthorized system access.
How do I fix CVE-2025-11899?
To fix CVE-2025-11899, it is essential to update Agentflow to the latest version where the hard-coded cryptographic key vulnerability has been addressed.
Who is affected by CVE-2025-11899?
Organizations using vulnerable versions of Flowring Agentflow are at risk from CVE-2025-11899.
What is the impact of exploiting CVE-2025-11899?
Exploiting CVE-2025-11899 allows attackers to log in as any user, potentially leading to unauthorized data access.
Is authentication required to exploit CVE-2025-11899?
No, authentication is not required to exploit CVE-2025-11899, making it particularly dangerous for affected systems.