CVE-2026-56271

Critical · CVSS 9.8

Flowise — Hardcoded default JWT secret authentication bypass

CVSS: 9.8; nvd
EPSS: —
KEV: No
Class: oss containerizable; CWE-321

Description

Flowise before 3.1.0 (affected versions 3.0.13 and earlier) uses weak hardcoded default JWT secrets ('auth_token', 'refresh_token') and default audience and issuer values ('AUDIENCE', 'ISSUER') in the enterprise passport authentication middleware (packages/server/src/enterprise/middleware/passport/index.ts). When the corresponding environment variables (JWT_AUTH_TOKEN_SECRET, JWT_REFRESH_TOKEN_SECRET, JWT_AUDIENCE, JWT_ISSUER) are not set, the application silently falls back to these publicly known defaults, allowing an attacker to forge valid JWTs and impersonate any user, including administrators, resulting in authentication bypass.

Search profile — drives PoC discovery

Symbols auth_tokenrefresh_tokenAUDIENCEISSUERJWT_AUTH_TOKEN_SECRETJWT_REFRESH_TOKEN_SECRETJWT_AUDIENCEJWT_ISSUERpackages/server/src/enterprise/middleware/passport/index.ts

Keywords CVE-2026-56271Flowisehardcoded JWT secretauthentication bypassforged JWTpassport middlewareenterprise middlewareweak default secretCWE-321GHSA-cc4f-hjpj-g9p8flowise jwt impersonationflowise auth bypass poc

Versions: <= 3.0.13

Affected packages

npm

flowise

0 → 3.1.0

References

Status: enriched · ingested 2026-07-13T18:00:21.000Z · profiled 2026-07-13T18:30:21.000Z