Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: Flowise 3.1.0 Clear all filters
TI-2026-40635 CVE-2026-56270 · GHSA-6pcv-j4jx-m4vx

Flowise - Unauthenticated OAuth Secrets Disclosure via /api/v1/loginmethod Endpoint

Priority HIGH 77

Flowise before 3.1.0 (versions 3.0.13 and earlier) contains a missing authentication vulnerability in the /api/v1/loginmethod endpoint that allows unauthenticated users to retrieve an organization's complete SSO configur…

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.02048 Published 2026-06-24 Fixed in 3.1.0 CWE-306
TI-2026-40634 CVE-2026-56269 · GHSA-m7mq-85xj-9x33

Flowise - Weak Default Token Hash Secret in JWT Token Encryption

Priority LOW 19

Flowise before 3.1.0 (npm package flowise, versions 3.0.13 and earlier) uses a weak hardcoded default value 'Secre$t' for the TOKEN_HASH_SECRET environment variable in packages/server/src/enterprise/utils/tempTokenUtils.…

CVSS 4.0MEDIUM 4.3 Local High privileges User interaction EPSS 0.00129 Published 2026-06-24 Fixed in 3.1.0 CWE-798