CVE-2026-100607

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.5

Description The software resolves Single Sign-On (SSO) and local-password users based only on the email address, failing to store provider or subject identifier bindings. This allows an attacker to authenticate as any existing user by claiming the target email address through any configured SSO provider or by using a local password, regardless of the victim's original registration method. Successful exploitation grants full account access, including chatflows, credentials, and API keys.

Recommendations Update to version 3.1.5 or later.