CVE-2026-100606 Details
Description
Flowise through 3.1.4 (Enterprise/platform mode with SSO enabled) contains an authentication bypass in the SSO login path. When an SSO callback arrives with an email matching a user whose status is INVITED, verifyAndLogin (SSOBase.ts:80-94) copies the user record from the database — including the server-stored single-use invitation tempToken — into the data passed to AccountService.register(). The register handler's token lookup, email match, and expiry checks therefore pass trivially against the server's own token instead of a caller-supplied one, and the account and its organization membership are flipped to ACTIVE. As a result, anyone able to authenticate at any configured SSO provider using a pending invitee's email address as the email claim can take over that invitation and obtain the invited user's access to the organization without ever possessing the emailed invitation token, for as long as the invitation is valid (24 hours by default). At the time of the advisory no patched version was available.
An authentication bypass vulnerability has been identified in Flowise versions through 3.1.4, specifically in the Enterprise platform mode with Single Sign-On (SSO) enabled. The issue arises in the SSO login process when a callback is received with an email corresponding to a user with an 'INVITED' status. The 'verifyAndLogin' function inadvertently copies the user's record from the database, including a single-use invitation token, and passes it to the 'AccountService.register()' method. This allows the invitation token validation to be bypassed, as the server's own token is used instead of one provided by the user. Consequently, anyone who can authenticate through a configured SSO provider using the email of an invited user can gain access to that user's organization without having the invitation token, as long as the invitation is valid (24 hours by default).
Flowise maintainers are recommended to modify the SSO login process to not automatically promote INVITED users. Instead, the system should require the user to complete the registration process by clicking the invitation link and providing the necessary token. Additionally, organizations using Flowise Enterprise can disable the invitation-by-email flow and manually onboard users via direct SSO provisioning.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-vf3j-89vf-r697 | [email protected] | AdvisoryBundleExploitRemedyVendor |
| https://www.vulncheck.com/advisories/flowise-through-3.1.4-authentication-bypass-via-sso-email-match | [email protected] | AdvisoryBundleRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-287 | Improper Authentication | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Flowise | <= 3.1.4 (semver) |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 26, 2026 | New CVE Received | [email protected] |