EUVD-2026-40433
GHSA-c973-v3cg-wcw4
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote, low-complexity, unauthenticated forgery of a known signing key (AV:N/AC:L/PR:N/UI:N) yields full account/admin impersonation (C:H/I:H); no availability impact and no scope change.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Flowise before 3.1.0 (affected versions 3.0.13 and earlier) uses a weak hardcoded default secret ('flowise') for the express-session middleware when the EXPRESS_SESSION_SECRET environment variable is not set (packages/server/src/enterprise/middleware/passport/index.ts). Because this default secret is publicly visible in the source code, an attacker can forge valid signed session cookies to impersonate any user and bypass authentication.
AnalysisAI
Authentication bypass in Flowise 3.0.13 and earlier lets unauthenticated remote attackers forge valid signed session cookies and impersonate any user, including administrators. The flaw stems from a publicly known hardcoded default secret ('flowise') used by the express-session middleware whenever the EXPRESS_SESSION_SECRET environment variable is left unset - the default deployment state. No public exploit identified at time of analysis, but forgery is trivial since the signing key is visible in the source code, and CVSS 4.0 rates it 9.3 (Critical).
Technical ContextAI
Flowise is an open-source low-code/visual builder for LLM orchestration and agent workflows (Node.js/Express backend). The vulnerable component is the enterprise authentication layer at packages/server/src/enterprise/middleware/passport/index.ts, which wires Passport sessions through Express's express-session middleware. express-session uses a secret to HMAC-sign the session ID cookie so the server can detect tampering. The root cause maps to CWE-798 (Use of Hard-coded Credentials): when EXPRESS_SESSION_SECRET is not provided, the code falls back to the literal string 'flowise'. Because that constant lives in the public GitHub repository, the cookie-signing key is effectively known to everyone, defeating the integrity guarantee the signature is meant to provide. The single affected CPE is cpe:2.3:a:flowise:flowise:*:*:*:*:*:*:*:*.
RemediationAI
Vendor-released patch: upgrade to Flowise 3.1.0 or later, which removes the insecure hardcoded fallback. As an immediate compensating control that works even before upgrading, explicitly set the EXPRESS_SESSION_SECRET environment variable to a long, high-entropy random value (e.g., 32+ random bytes) and restart the service - this replaces the publicly known signing key and invalidates the cookie-forgery technique; the only side effect is that existing user sessions are invalidated and users must re-authenticate. Additionally, until patched, restrict network exposure of the Flowise UI/API to trusted networks or behind a VPN/reverse-proxy with its own authentication, since the bug is remotely reachable. Refer to the vendor advisory at https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-2qqc-p94c-hxwh and the VulnCheck advisory at https://www.vulncheck.com/advisories/flowise-session-hijacking-via-weak-default-express-session-secret for confirmation of fixed versions.
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Flowise versions before 3.0.1 allow unauthenticated access to the Custom MCPs feature, which is designed to execute OS c
FlowiseAI Flowise version 2.2.6 contains an arbitrary file upload vulnerability in the /api/v1/attachments endpoint. Una
Remote code execution in Flowise before 3.1.2 allows any authenticated user (or API caller with chatflow view/update per
Flowise is a drag & drop user interface to build a customized large language model flow. Rated critical severity (CVSS 9
Unrestricted file upload in Flowise LLM workflow builder before 3.0.13 via /api/v1/attachments endpoint allows unauthent
Missing authentication on NVD data endpoint in Flowise before 3.0.13 allows unauthenticated access to internal vulnerabi
Remote code execution in Flowise before 3.1.3 arises because its Pyodide Python-code validator (validatePythonCodeForDat
Remote command execution in Flowise <= 3.1.2 lets an authenticated user break out of the vm2/@flowiseai/nodevm JavaScrip
Arbitrary file read and write in FlowiseAI Flowise (versions 2.2.8 through 3.0.5) lets remote unauthenticated attackers
Authenticated remote code execution in FlowiseAI Flowise prior to 3.1.2 allows any user with a valid session or API key
Remote code execution in Flowise before 3.1.3 lets authenticated users abuse the Custom MCP node - when CUSTOM_MCP_PROTO
Same weakness CWE-798 – Use of Hard-coded Credentials
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today