ZDI-CAN-28762: ZDI-26-300: Flowise AccountService resetPassword Authentication Bypass Vulnerability

Published Apr 27, 2026

Updated

This vulnerability allows remote attackers to bypass authentication on affected installations of Flowise. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.1. The following CVEs are assigned: CVE-2026-41276.

Affected Software

1 affected component

Flowise

Event History

Apr 27, 2026

Advisory Published

via ZDI·05:00 AM

Data Sourced

via ZDI·05:00 AM

Description

Frequently Asked Questions

What is the severity of ZDI-CAN-28762?

ZDI-CAN-28762 has a CVSS rating of 8.1, indicating a high severity vulnerability.

How do I fix ZDI-CAN-28762?

To mitigate ZDI-CAN-28762, update your Flowise installation to the latest patched version provided by the vendor.

What are the risks associated with ZDI-CAN-28762?

ZDI-CAN-28762 allows remote attacks to bypass authentication, potentially leading to unauthorized access and data compromise.

Which versions of Flowise are affected by ZDI-CAN-28762?

All versions of Flowise prior to the patched update are vulnerable to ZDI-CAN-28762.

Is authentication required to exploit ZDI-CAN-28762?

No, authentication is not required to exploit ZDI-CAN-28762, making it particularly dangerous.