CVE-2026-2095

Summary

Agentflow developed by Flowring has an Authentication Bypass vulnerability, allowing unauthenticated remote attackers to exploit a specific functionality to obtain arbitrary user authentication token and log into the system as any user.

Affected Software

Weaknesses

• CWE-288: CWE-288 Authentication Bypass Using an Alternate Path or Channel

Workarounds

Please refer to the following official instructions and take the appropriate mitigation measures: https://forum.flowring.com/post/view?bid=72&id=45611&tpg=1&ppg=1&sty=1#45939

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: yes
  • Technical Impact: total

References

• https://www.twcert.org.tw/tw/cp-132-10699-49c0b-1.html
• https://www.twcert.org.tw/en/cp-139-10700-3534d-2.html
• https://forum.flowring.com/post/view?bid=72&id=45611&tpg=1&ppg=1&sty=1#45939

• ←Previous
• Next→