Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.2

Flowise SSO lets anyone claim an invite by email

CVE-2026-100606 · published 14 days ago
Summary

When Flowise is set up with single sign‑on, an email address used for an invitation can be used to log in without the invitation token. Anyone who can sign in to the same SSO provider and supplies the invited email can gain the invited user's access for up to 24 hours. Update to a newer version of Flowise as soon as a fix is released, or temporarily disable SSO for invitation flow.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
flowiseai flowise <= 3.1.4
Original advisory text
Flowise through 3.1.4 Authentication Bypass via SSO Email Match
Flowise through 3.1.4 (Enterprise/platform mode with SSO enabled) contains an authentication bypass in the SSO login path. When an SSO callback arrives with an email matching a user whose status is INVITED, verifyAndLogin (SSOBase.ts:80-94) copies the user record from the database — including the server-stored single-use invitation tempToken — into the data passed to AccountService.register(). The register handler's token lookup, email match, and expiry checks therefore pass trivially against the server's own token instead of a caller-supplied one, and the account and its organization membership are flipped to ACTIVE. As a result, anyone able to authenticate at any configured SSO provider using a pending invitee's email address as the email claim can take over that invitation and obtain the invited user's access to the organization without ever possessing the emailed invitation token, for as long as the invitation is valid (24 hours by default). At the time of the advisory no patched version was available.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
9.2 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-287Improper Authentication
Timeline
Published26 Sep 2026
Updated9 Oct 2026
First seen26 Sep 2026
Sources
CVE-2026-100606 · NVD
CVE-2026-100606 · MITRE
CVE-2026-100606 · OSV
GHSA-vf3j-89vf-r697 · GHSA
Track software like this
Free during beta