CVE-2026-56270 Details
Description
Flowise before 3.1.0 (versions 3.0.13 and earlier) contains a missing authentication vulnerability in the /api/v1/loginmethod endpoint that allows unauthenticated users to retrieve an organization's complete SSO configuration, including OAuth client secrets in cleartext, by providing an organizationId parameter. Remote attackers can send a GET request to harvest sensitive API credentials for Google, Microsoft/Azure, GitHub, and Auth0 integrations. This affects FlowiseAI Cloud and self-hosted instances where the endpoint is exposed.
A missing authentication vulnerability has been identified in Flowise versions prior to 3.1.0, specifically in the /api/v1/loginmethod endpoint. This vulnerability allows unauthenticated users to access an organization's entire Single Sign-On (SSO) configuration, including sensitive OAuth client secrets in cleartext, by supplying an organizationId parameter. The issue can be exploited by sending a GET request, which retrieves confidential API credentials for integrations with Google, Microsoft/Azure, GitHub, and Auth0. This vulnerability impacts both FlowiseAI Cloud and self-hosted instances where the endpoint is accessible.
Users are advised to update Flowise to version 3.1.0 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-6pcv-j4jx-m4vx | CISA-ADP | ExploitVendor Advisory |
| https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-6pcv-j4jx-m4vx | [email protected] | ExploitVendor Advisory |
| https://www.vulncheck.com/advisories/flowise-unauthenticated-oauth-secrets-disclosure-via-api-v1-loginmethod-endpoint | [email protected] | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| flowiseai flowise | < 3.1.0 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 26, 2026 | Initial Analysis | [email protected] |
| Jun 24, 2026 | New CVE Received | [email protected] |
| Jun 24, 2026 | CVE Modified | CISA-ADP |