Skip to content
Threat Feed
Subscribe

Product

Flowise (< 3.1.0)

1 brief RSS
critical advisory

Flowise Authentication Bypass via Hardcoded JWT Secrets (CVE-2026-56271)

Flowise versions 3.0.13 and earlier are vulnerable due to hardcoded default JWT secrets ('auth_token', 'refresh_token') and default audience/issuer values ('AUDIENCE', 'ISSUER'), allowing an attacker to forge valid JWTs and impersonate any user, including administrators, leading to an authentication bypass if environment variables are not explicitly set.

Flowise authentication-bypass jwt hardcoded-credentials web-application critical-vulnerability
2t 1c