FlowiseAI Password Reset Link Sent Over Unsecured HTTP

Vulnerability Summary: Password Reset Link Sent Over Unsecured HTTP Overview Vulnerability Name: Password Reset Link Sent Over Unsecured HTTP Description: In , the password reset functionality sends the reset link via insecure HTTP protocol instead of HTTPS. This may lead to Man-in-the-Middle (MITM) attacks, where an attacker on the same network can intercept the reset link and gain unauthorized access to the victim's account. CVSS Score: 7.5 / 10 CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N Impact Scope Affected Versions: Fixed Version: Attack Vector: Network Attack Complexity: High Attack Requirements: Present Privileges Required: None User Interaction: Active Confidentiality Impact: High Integrity Impact: High Availability Impact: High Remediation Mitigation: Ensure that all sensitive URLs, especially password reset links, are generated and transmitted through secure HTTPS endpoints. Best Practices: - Use HTTPS in all password-related emails. - Implement HSTS (HTTP Strict Transport Security) to enforce secure connections. POC Code ```plaintext http://url6444.mail.flowiseai.com/ul/click?pn=001_wa38qBQxD8ACvFO3KPOEqb4nvV9B-2FRjNXRYD9y9CKM622C9ChG4-2BvQy73TycKl-2B5N2d6aQy4vIU7-2FJsX6GtKDHX2K4mp-2B-2FhMDPBX-2HRj8G7vM-2F5M1+1PQl63P5F4dGn2OW384A4xMC-P2sy0v2V1N6N9W8dV8ACxMC-3017EV-DW2bNY7bGf0bFNWv0z-2B4mN9y0rBFP-2B1hPQ1C6yX4Y2C9Y4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4w

Goal Reached Thanks to every supporter — we hit 100%!

FlowiseAI Password Reset Link Sent Over Unsecured HTTP

More from this source