CVE-2026-56271 Details
Description
Flowise before 3.1.0 (affected versions 3.0.13 and earlier) uses weak hardcoded default JWT secrets ('auth_token', 'refresh_token') and default audience and issuer values ('AUDIENCE', 'ISSUER') in the enterprise passport authentication middleware (packages/server/src/enterprise/middleware/passport/index.ts). When the corresponding environment variables (JWT_AUTH_TOKEN_SECRET, JWT_REFRESH_TOKEN_SECRET, JWT_AUDIENCE, JWT_ISSUER) are not set, the application silently falls back to these publicly known defaults, allowing an attacker to forge valid JWTs and impersonate any user, including administrators, resulting in authentication bypass.
A vulnerability exists in Flowise versions prior to 3.1.0, specifically in versions 3.0.13 and earlier. The issue arises from weak hardcoded default JSON Web Token (JWT) secrets and default values for audience and issuer in the enterprise passport authentication middleware. When the corresponding environment variables are not set, the application defaults to these publicly known values, allowing attackers to forge valid JWTs and impersonate any user, including administrators, thereby bypassing authentication.
Users are advised to remove all default JWT secrets and ensure that all JWT environment variables are explicitly set with strong, cryptographically random values. Additionally, implement a validation step during application startup to check for the presence of these variables and throw an error if any are missing.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-cc4f-hjpj-g9p8 | [email protected] | Vendor Advisory |
| https://www.vulncheck.com/advisories/flowise-weak-default-jwt-secrets-in-authentication-middleware | [email protected] | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-321 | Use of Hard-coded Cryptographic Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| flowiseai flowise | < 3.1.0 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 14, 2026 | Initial Analysis | [email protected] |
| Jul 13, 2026 | CVE Modified | CISA-ADP |
| Jul 12, 2026 | New CVE Received | [email protected] |