CVE-2025-3709 Flowring Technology Agentflow - Account Lockout Bypass

What is CVE-2025-3709?

CVE-2025-3709 is a critical vulnerability in Flowring Technology Agentflow, published on 2 May 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Agentflow from Flowring Technology has an Account Lockout Bypass vulnerability, allowing unauthenticated remote attackers to exploit this vulnerability to perform password brute force attack.

Weakness: CWE-307

Which versions are affected by CVE-2025-3709?

It affects 1 product.

Products include Flowring Agentflow.

How do I fix CVE-2025-3709?

No fix has been published for CVE-2025-3709 yet. Limit exposure of the affected software until one is available.

Is CVE-2025-3709 being exploited?

There is no known exploitation of CVE-2025-3709 in the wild and no public exploit code.

Other vulnerabilities in Flowring Technology Agentflow

• CVE-2022-39036 FLOWRING Agentflow BPM - Arbitrary File Upload Critical 9.8
• CVE-2026-2095 Flowring｜Agentflow - Authentication Bypass Critical 9.3
• CVE-2026-2096 Flowring｜Agentflow - Missing Authenticaton Critical 9.3
• CVE-2022-39038 FLOWRING Agentflow BPM - Broken Access Control High 8.8
• CVE-2026-2097 Flowring｜Agentflow - Arbitrary File Upload High 8.7

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-225p-wqpv-w4vg.