# CVE-2026-41276: Flowise: resetPassword Authentication Bypass Vulnerability

Source: https://junglewise.ai/threats/cve-2026-41276-flowise-resetpassword-authentication-bypass-vulnerability  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-23. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-41276 · Severity: critical · CVSS 9.8 · Published 2026-04-23

Flowise is a low-code platform for building AI and large language model applications with a web-based interface and REST API. A flaw in the password reset mechanism allows attackers to reset any user's password without authorization by submitting a null or empty token value, potentially compromising account security and enabling unauthorized access to the platform and its integrated AI systems.

Technologies: [FlowiseAI Flowise](https://junglewise.ai/threats/technologies/flowiseai-flowise), [flowise (npm)](https://junglewise.ai/threats/technologies/flowise). Vendors: [FlowiseAI](https://junglewise.ai/threats/vendors/flowiseai), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-41276 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-41276 being exploited in the wild.

**How severe is CVE-2026-41276?** Critical severity, with a CVSS score of 9.8, published 23 April 2026.

**Which products and versions are affected?** flowise (npm) <= 3.0.13, SEMVER:introduced=0,fixed=3.1.0.

**Is there a fix for CVE-2026-41276?** Yes. flowise (npm): upgrade to 3.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-41276 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-41276?** Check whether you run FlowiseAI Flowise or flowise (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- flowise (npm): upgrade to 3.1.0 or later

  ```sh
  npm install flowise@3.1.0
  ```


## Technical details

The resetPassword() method in the AccountService class fails to verify that a password reset token was actually generated before validating it. By default, the reset token field is null or empty, which matches a null/empty token submitted by an attacker. The vulnerability exists in the /api/v1/account/reset-password endpoint and requires only knowledge of a target user's email address and no prior authentication. An attacker can exploit this within 15 minutes of account creation (or per the PASSWORD_RESET_TOKEN_EXPIRY_IN_MINUTES setting) to change the target user's password and gain full account access. Flowise version 3.0.13 and earlier are affected; patch is available in version 3.1.0 or later.

## Affected products

- FlowiseAI Flowise <= 3.0.13

## Identifiers

- CVE-2026-41276
- GHSA-f6hc-c5jr-878p

## Timeline

- 2026-04-16: disclosed
- 2026: patched: Fixed in version 3.1.0

## References

- [https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-f6hc-c5jr-878p](https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-f6hc-c5jr-878p)

## Related threats

- [Flowise sandbox escape in custom function endpoint](https://junglewise.ai/threats/cve-2026-119978-flowise-through-3-1-4-contains-a-sandbox-escape-vulnerability)
- [Duplicate Advisory: INVITED users auto-promoted via SSO email match (invite-token bypass)](https://junglewise.ai/threats/duplicate-advisory-invited-users-auto-promoted-via-sso-email-match-d290aa10)
- [Flowise credential lookup authorization bypass](https://junglewise.ai/threats/cve-2026-100609-flowise-npm-packages-flowise-and-flowise-components-through-3-1)
- [Flowise authentication bypass via email-only SSO matching](https://junglewise.ai/threats/cve-2026-100607-flowise-through-3-1-4-resolves-sso-and-local-password-users)
- [Flowise authentication bypass in SSO login path](https://junglewise.ai/threats/cve-2026-100606-flowise-through-3-1-4-enterprise-platform-mode-with-sso-enabled)