{"id":"EUVD-2026-38748","enisaUuid":"b225f33a-c09b-3d40-8ba6-23c112930caf","description":"Flowise before 3.0.13 uses bcrypt with default salt rounds of 5, providing only 32 iterations instead of the OWASP-recommended minimum of 10 rounds. Attackers can crack password hashes approximately 30 times faster with modern GPU hardware, potentially compromising all user accounts in a database breach scenario.","datePublished":"Jun 24, 2026, 11:53:15 AM","dateUpdated":"Jun 24, 2026, 3:52:44 PM","baseScore":5.6,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:L/AC:H/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-x2g5-fvc2-gqvp\nhttps://www.vulncheck.com/advisories/flowise-insufficient-password-salt-rounds-in-bcrypt-hashing\n","aliases":"CVE-2026-56272\n","assigner":"VulnCheck","epss":0.1,"enisaIdProduct":[{"id":"0b1c6737-cefa-34a7-88d0-706b80288771","product":{"name":"Flowise","vendor":{"name":"FlowiseAI"}},"product_version":"0 \u003c3.0.13"}],"enisaIdVendor":[{"id":"564bef29-323b-3193-ba1a-efa66fb3816d","vendor":{"name":"Flowise"}}],"enisaIdVulnerability":[{"id":"8b1e6d23-18b6-37c6-91cb-b9d84fbb98a2","vulnerability":{"id":"CVE-2026-56272","description":"Flowise before 3.0.13 uses bcrypt with default salt rounds of 5, providing only 32 iterations instead of the OWASP-recommended minimum of 10 rounds. Attackers can crack password hashes approximately 30 times faster with modern GPU hardware, potentially compromising all user accounts in a database breach scenario.","datePublished":"Jun 24, 2026, 11:53:15 AM","dateUpdated":"Jun 24, 2026, 3:52:44 PM","status":"PUBLISHED","baseScore":5.6,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:L/AC:H/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-x2g5-fvc2-gqvp\nhttps://www.vulncheck.com/advisories/flowise-insufficient-password-salt-rounds-in-bcrypt-hashing\n","enisa_id":"EUVD-2026-38748\n","assigner":"VulnCheck","epss":0.1,"dataProcessed":"Nov 7, 2026, 7:20:58 AM","vulnerabilityProduct":[{"id":"78cfda29-4bfb-3f8e-af94-e1704c9b88f2","product":{"name":"Flowise","vendor":{"name":"FlowiseAI"}},"product_version":"0 \u003c3.0.13"}],"vulnerabilityVendor":[{"id":"1ef628be-28c5-34dd-9ea6-dc5b5f2729b1","vendor":{"name":"Flowise"}}]}}],"enisaIdAdvisory":[]}