Flowise CVE-2026-100606

Requires Flowise 3.1.4 or earlier running in Enterprise/platform mode with SSO enabled and at least one configured SSO provider. There must be a target user account in INVITED status with a valid, unexpired invitation (24-hour default window). The attacker must be able to authenticate at one of the configured SSO providers while asserting the pending invitee's email address as the email claim - the practical limiting factor, since it depends on the trust and email-verification behavior of the SSO provider(s). No Flowise-side credentials, no possession of the emailed invitation token, and no user interaction from the victim are needed. Instances not in Enterprise/SSO mode, or with no outstanding invitations, are not exploitable.

This is a genuine, high-quality authentication bypass (CWE-287): the SSO login path in Flowise Enterprise/platform mode lets an attacker who authenticates at any configured SSO provider with a pending invitee's email claim inherit the server's own single-use invitation tempToken, flipping the target account and its org membership to ACTIVE without ever possessing the emailed token. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L, 9.2) rates it CRITICAL. AT:P (present attack requirement) and PR:N are appropriate - no Flowise credential is needed - but AC:L is generous: exploitation requires an active pending invitation (24h window) AND the ability to assert an arbitrary email as the SSO email claim, which is a real precondition, so I assess AC:H and score it closer to ~7.1 (HIGH). No EPSS score, no CISA KEV listing, and no public exploit code are present in the input, so this is not confirmed as widely or actively exploited; it is a real priority for Flowise Enterprise+SSO operators (clean bypass, no patch at advisory time) but its practical reach is bounded by the narrow deployment gate rather than being a mass-exploited flaw. No conflicting signals in the CVSS-vs-description data; the vector and description agree on network, unauthenticated (to Flowise), no-UI exploitation.

An organization sends a Flowise invitation to alice@corp.com, leaving her account in INVITED status. Before Alice accepts, an attacker who can present alice@corp.com as the email claim at one of the org's configured SSO providers completes an SSO login; verifyAndLogin loads Alice's DB record with its server-stored tempToken and passes it to register(), so the token/email/expiry checks trivially succeed and the attacker's session is activated as Alice with her intended org access. No emailed invitation token is required and no public exploit code is identified at time of analysis.