CVE-2026-46440

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.2

Description The 'checkBasicAuth' endpoint validates credentials in plaintext using direct comparison without rate limiting. This allows attackers to perform unlimited brute-force attempts against the username and password variables to gain access to the application. Additionally, the use of the JavaScript === operator for comparison may enable timing attacks, and the endpoint returns distinct messages for success and failure, which facilitates credential enumeration.

Recommendations Update to version 3.1.2. Implement rate limiting on the 'checkBasicAuth' endpoint. Use constant-time comparison to prevent timing attacks. Use hashed comparison for credentials. Return generic error messages for authentication failures. Add logging for failed authentication attempts.