CVE-2026-100607 Details

A vulnerability in Flowise through version 3.1.4 allows for authentication bypass via email-only single sign-on (SSO) matching. The application resolves SSO and local-password users solely by email, without storing provider or subject identifier bindings. This flaw enables attackers to authenticate as any existing user by claiming their email at any configured SSO provider. Exploitation can lead to complete account access, including chatflows, credentials, and API keys, by authenticating through a different SSO provider or local password than the victim's original registration method.

To address this vulnerability, Flowise should implement a binding table that maps each SSO provider and subject identifier to a user account, ensuring that authentication is based on these bindings rather than email alone. Existing users should be migrated to this new system, and organizations should be advised to disable local-password authentication if any SSO provider is configured.