Flowise: Flowise before 3.1.0 (affected versions 3.0.13 and earlier) uses weak hardcoded default JWT…
Flowise
More for Flowise RSS feed for Flowise
- Severity
- Critical, CVSS 9.8
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Record
- CVE-2026-56271
- Affects
- Flowise
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- July 12, 2026
- Source last modified
- October 25, 2026
Description
Flowise before 3.1.0 (affected versions 3.0.13 and earlier) uses weak hardcoded default JWT secrets ('auth_token', 'refresh_token') and default audience and issuer values ('AUDIENCE', 'ISSUER') in the enterprise passport authentication middleware (packages/server/src/enterprise/middleware/passport/index.ts). When the corresponding environment variables (JWT_AUTH_TOKEN_SECRET, JWT_REFRESH_TOKEN_SECRET, JWT_AUDIENCE, JWT_ISSUER) are not set, the application silently falls back to these publicly known defaults, allowing an attacker to forge valid JWTs and impersonate any user, including administrators, resulting in authentication bypass.
Description quoted from the NVD record.
Who is affected
Flowise is a tool for building apps that use AI language models. This flaw affects Flowise versions before 3.1.0, meaning 3.0.13 and earlier. The problem is in the enterprise sign-in feature. If the secret settings that protect login tokens are not filled in, Flowise quietly uses publicly known default values instead. An attacker who knows those defaults could create fake login tokens, pretend to be any user, including administrators, and get past the login entirely. This flaw is rated Critical.
What to do
- The person who installed or runs Flowise for your organization should handle this.
- If an IT provider or vendor runs Flowise for you, send them this advisory and ask when the update will be done.
- Update Flowise to version
3.1.0or later, which fixes this flaw. - If you are not sure which version you have, ask the person who runs Flowise to check. Versions 3.0.13 and earlier are affected.
- If you do not know whether your organization uses Flowise at all, ask whoever looks after your computers and online services.
Analysis written from the source record as of October 25, 2026 and reviewed before publishing.