Authentication Bypass in Flowise SSO Callback

Flowise versions up to 3.1.4 are vulnerable to an authentication bypass when deployed in enterprise or platform mode with SSO enabled. The issue stems from the verifyAndLogin function in SSOBase.ts, which handles SSO callback requests for users with a status of INVITED. During this process, the application incorrectly copies the server-stored, single-use tempToken into the data payload sent to AccountService.register(). Because the registration handler validates the token against this server-side copy rather than a caller-supplied value, an attacker can bypass the invitation token requirement. By authenticating via a configured SSO provider using the email address of a pending invitee, an attacker can flip the user account status to ACTIVE and gain full access to the target organization's resources. This bypass is possible as long as the invitation remains valid, typically within a 24-hour window. No patches were available at the time of initial disclosure.

Impact

Successful exploitation allows unauthenticated attackers to hijack user invitations, leading to unauthorized access to Flowise organizations. This enables attackers to impersonate invited users, access proprietary data, and manipulate application workflows within the organization, posing a significant risk to the confidentiality and integrity of platform environments.

Recommendation

Prioritize the identification and monitoring of SSO authentication traffic for the Flowise application. Until a patch is released, disable SSO integration for Flowise enterprise or platform deployments if possible, or enforce strict access control lists on the SSO provider to restrict the scope of trusted users.