EUVD-2026-43228
GHSA-jpvq-qwhh-pw47
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote unauthenticated JWT forgery needs no privileges or interaction (AV:N/AC:L/PR:N/UI:N); admin impersonation yields full C/I/A impact within the app (S:U).
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Flowise before 3.1.0 (affected versions 3.0.13 and earlier) uses weak hardcoded default JWT secrets ('auth_token', 'refresh_token') and default audience and issuer values ('AUDIENCE', 'ISSUER') in the enterprise passport authentication middleware (packages/server/src/enterprise/middleware/passport/index.ts). When the corresponding environment variables (JWT_AUTH_TOKEN_SECRET, JWT_REFRESH_TOKEN_SECRET, JWT_AUDIENCE, JWT_ISSUER) are not set, the application silently falls back to these publicly known defaults, allowing an attacker to forge valid JWTs and impersonate any user, including administrators, resulting in authentication bypass.
AnalysisAI
Authentication bypass in Flowise 3.0.13 and earlier lets remote unauthenticated attackers forge valid JWTs and impersonate any user, including administrators, because the enterprise passport authentication middleware silently falls back to publicly known hardcoded secrets ('auth_token', 'refresh_token') and default audience/issuer values ('AUDIENCE', 'ISSUER') whenever the JWT_AUTH_TOKEN_SECRET, JWT_REFRESH_TOKEN_SECRET, JWT_AUDIENCE, and JWT_ISSUER environment variables are unset. Reported by VulnCheck and rated CVSS 4.0 9.3 (Critical), it grants full account takeover, though there is no public exploit identified at time of analysis and no CISA KEV listing.
Technical ContextAI
Flowise is an open-source low-code platform for building LLM/agent workflows; the affected code is its enterprise-tier authentication layer, packages/server/src/enterprise/middleware/passport/index.ts, which uses Passport with JWT strategies. JWT integrity depends entirely on a server-side signing secret plus matching audience and issuer claims. The root cause is CWE-321 (Use of Hard-coded Cryptographic Key): rather than failing closed when JWT_AUTH_TOKEN_SECRET, JWT_REFRESH_TOKEN_SECRET, JWT_AUDIENCE, or JWT_ISSUER are absent, the middleware substitutes constant literals ('auth_token', 'refresh_token', 'AUDIENCE', 'ISSUER'). Because these values are visible in the public source repository, anyone can reproduce the exact signing key and claim set, sign a token for an arbitrary user id and role, and have it accepted as authentic. The affected component is identified by cpe:2.3:a:flowise:flowise.
RemediationAI
Vendor-released patch: upgrade Flowise to 3.1.0 or later, which is the primary and authoritative fix per the GitHub Security Advisory GHSA-cc4f-hjpj-g9p8 (https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-cc4f-hjpj-g9p8). If immediate upgrade is not possible, the effective compensating control is to explicitly set strong, unique, high-entropy values for all four environment variables - JWT_AUTH_TOKEN_SECRET, JWT_REFRESH_TOKEN_SECRET, JWT_AUDIENCE, and JWT_ISSUER - so the application no longer falls back to the hardcoded defaults; this must be done on every instance, and any previously issued tokens should be treated as compromised and rotated. Additionally restrict network exposure of the Flowise server behind a VPN or authenticated reverse proxy and limit access to trusted networks, accepting the trade-off of reduced accessibility for legitimate remote users, until patching is complete. See the VulnCheck advisory (https://www.vulncheck.com/advisories/flowise-weak-default-jwt-secrets-in-authentication-middleware) for further detail.
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Flowise versions before 3.0.1 allow unauthenticated access to the Custom MCPs feature, which is designed to execute OS c
FlowiseAI Flowise version 2.2.6 contains an arbitrary file upload vulnerability in the /api/v1/attachments endpoint. Una
Remote code execution in Flowise before 3.1.2 allows any authenticated user (or API caller with chatflow view/update per
Flowise is a drag & drop user interface to build a customized large language model flow. Rated critical severity (CVSS 9
Unrestricted file upload in Flowise LLM workflow builder before 3.0.13 via /api/v1/attachments endpoint allows unauthent
Missing authentication on NVD data endpoint in Flowise before 3.0.13 allows unauthenticated access to internal vulnerabi
Remote code execution in Flowise before 3.1.3 arises because its Pyodide Python-code validator (validatePythonCodeForDat
Arbitrary file read and write in FlowiseAI Flowise (versions 2.2.8 through 3.0.5) lets remote unauthenticated attackers
Authenticated remote code execution in FlowiseAI Flowise prior to 3.1.2 allows any user with a valid session or API key
Privilege escalation in Flowise versions prior to 3.0.13 allows authenticated users to bypass API authorization by spoof
Flowise versions up to 3.0.13 is affected by authorization bypass through user-controlled key (CVSS 8.8).
Same weakness CWE-321 – Use of Hard-coded Cryptographic Key
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today