Flowise: Flowise before 3.1.0 (versions 3.0.13 and earlier) contains a missing authentication…
Flowise
More for Flowise RSS feed for Flowise
- Severity
- High, CVSS 7.5
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Record
- CVE-2026-56270
- Affects
- Flowise
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- June 24, 2026
- Source last modified
- June 26, 2026
Description
Flowise before 3.1.0 (versions 3.0.13 and earlier) contains a missing authentication vulnerability in the /api/v1/loginmethod endpoint that allows unauthenticated users to retrieve an organization's complete SSO configuration, including OAuth client secrets in cleartext, by providing an organizationId parameter. Remote attackers can send a GET request to harvest sensitive API credentials for Google, Microsoft/Azure, GitHub, and Auth0 integrations. This affects FlowiseAI Cloud and self-hosted instances where the endpoint is exposed.
Description quoted from the NVD record.
Who is affected
Flowise is a tool for building apps that use AI language models. This flaw affects Flowise versions 3.0.13 and earlier (all versions before 3.1.0). It affects both FlowiseAI Cloud and self-hosted setups where the affected part is reachable. A part of the product that handles login method settings does not check who is asking. A remote attacker who supplies your organization's ID can read your full single sign-on settings. These include the secret keys that connect Flowise to Google, Microsoft/Azure, GitHub and Auth0 logins, shown in plain text. This flaw is rated High.
What to do
- Whoever installed and runs Flowise on your organization's own servers should update it to version
3.1.0or later. All versions up to and including 3.0.13 have this flaw. - If an IT provider or vendor runs Flowise for your organization, send them this advisory and ask when the update to
3.1.0will be done. - If your organization uses FlowiseAI Cloud, send this advisory to FlowiseAI support and ask when the fix will be in place for your account.
Analysis written from the source record as of June 26, 2026 and reviewed before publishing.