CVE-2026-2095: Flowring Agentflow

Critical severity, CVSS 9.8. EPSS: 0.6% chance of exploitation in the next 30 days.

Agentflow developed by Flowring has an Authentication Bypass vulnerability, allowing unauthenticated remote attackers to exploit a specific functionality to obtain arbitrary user authentication token and log into the system as any user.

Affected products

Published 2026-02-10. Last modified 2026-06-17.