CVE-2026-56271

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.0

Description The enterprise passport authentication middleware in packages/server/src/enterprise/middleware/passport/index.ts uses weak hardcoded default values for JWT secrets (auth token, refresh token) and audience/issuer values (AUDIENCE, ISSUER). If the environment variables JWT AUTH TOKEN SECRET, JWT REFRESH TOKEN SECRET, JWT AUDIENCE, and JWT ISSUER are not configured, the application silently falls back to these publicly known defaults. This allows an unauthenticated attacker to forge valid JSON Web Tokens (JWT) and impersonate any user, including administrators, leading to a complete authentication bypass and full takeover of the instance.

Recommendations Upgrade to version 3.1.0. Manually configure the JWT AUTH TOKEN SECRET, JWT REFRESH TOKEN SECRET, JWT AUDIENCE, and JWT ISSUER environment variables with strong, unique, and cryptographically random secrets of 256 bits or more.