CVE-2026-56271 PUBLISHED

Flowise before 3.1.0 (affected versions 3.0.13 and earlier) uses weak hardcoded default JWT secrets ('auth_token', 'refresh_token') and default audience and issuer values ('AUDIENCE', 'ISSUER') in the enterprise passport authentication middleware (packages/server/src/enterprise/middleware/passport/index.ts). When the corresponding environment variables (JWT_AUTH_TOKEN_SECRET, JWT_REFRESH_TOKEN_SECRET, JWT_AUDIENCE, JWT_ISSUER) are not set, the application silently falls back to these publicly known defaults, allowing an attacker to forge valid JWTs and impersonate any user, including administrators, resulting in authentication bypass.

• kolega-ai-dev reporter

• GitHub Security Advisory (GHSA-cc4f-hjpj-g9p8)
• VulnCheck Advisory: Flowise - Weak Default JWT Secrets in Authentication Middleware

• Use of Hard-coded Cryptographic Key CWE