PT-2026-54029

CVE-2026-56278

Published

2026-04-16

Updated

2026-07-06

Description by

CVSS 4.0

9.3

Critical

MetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Flowise versions 3.0.13 and earlier

Description The software uses a weak hardcoded default secret ('flowise') for the express-session middleware when the EXPRESS SESSION SECRET environment variable is not set. Since this secret is publicly visible in the source code, an attacker can forge valid signed session cookies to impersonate any user and bypass authentication.

Recommendations Update to version 3.1.0 or later. Set the EXPRESS SESSION SECRET environment variable to a strong, unique value.

Exploitability

Exploit

Fix

Impacts

Researchers

Kolega-Ai-Dev

Vendors

Affected products

Weakness enumeration

CWE-798: Use of Hard-coded Credentials

Related identifiers