Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.3
CVE-2026-56271: Flowise - Default Secrets in JWT Authentication Exposed
CVE-2026-56271
CVE-2026-56271
Summary
Flowise versions 3.0.13 and earlier use weak default secrets in its JWT authentication system. This allows attackers to create fake authentication tokens, potentially impersonating administrators or other users. Update to Flowise version 3.1.0 or later to fix this issue.
What to do
No fix is available yet. Check with your software vendor for updates.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| flowise | flowise | < 3.1.0 |
Original title
Flowise before 3.1.0 (affected versions 3.0.13 and earlier) uses weak hardcoded default JWT secrets ('auth_token', 'refresh_token') and default audience and issuer values ('AUDIENCE', 'ISSUER') in ...
Original description
Flowise before 3.1.0 (affected versions 3.0.13 and earlier) uses weak hardcoded default JWT secrets ('auth_token', 'refresh_token') and default audience and issuer values ('AUDIENCE', 'ISSUER') in the enterprise passport authentication middleware (packages/server/src/enterprise/middleware/passport/index.ts). When the corresponding environment variables (JWT_AUTH_TOKEN_SECRET, JWT_REFRESH_TOKEN_SECRET, JWT_AUDIENCE, JWT_ISSUER) are not set, the application silently falls back to these publicly known defaults, allowing an attacker to forge valid JWTs and impersonate any user, including administrators, resulting in authentication bypass.
nvd CVSS3.1
9.8
nvd CVSS4.0
9.3
Vulnerability type
CWE-321
Use of Hard-coded Cryptographic Key
Published: 12 Jul 2026 · Updated: 20 Jul 2026 · First seen: 12 Jul 2026