{"id":"EUVD-2026-43228","enisaUuid":"678db068-aa4f-3302-bb7c-5fbcf3183186","description":"Flowise before 3.1.0 (affected versions 3.0.13 and earlier) uses weak hardcoded default JWT secrets (\u0027auth_token\u0027, \u0027refresh_token\u0027) and default audience and issuer values (\u0027AUDIENCE\u0027, \u0027ISSUER\u0027) in the enterprise passport authentication middleware (packages/server/src/enterprise/middleware/passport/index.ts). When the corresponding environment variables (JWT_AUTH_TOKEN_SECRET, JWT_REFRESH_TOKEN_SECRET, JWT_AUDIENCE, JWT_ISSUER) are not set, the application silently falls back to these publicly known defaults, allowing an attacker to forge valid JWTs and impersonate any user, including administrators, resulting in authentication bypass.","datePublished":"Jul 12, 2026, 12:06:32 PM","dateUpdated":"Jul 13, 2026, 3:41:09 PM","baseScore":9.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-cc4f-hjpj-g9p8\nhttps://www.vulncheck.com/advisories/flowise-weak-default-jwt-secrets-in-authentication-middleware\n","aliases":"CVE-2026-56271\nGHSA-jpvq-qwhh-pw47\n","assigner":"VulnCheck","epss":0.66,"enisaIdProduct":[{"id":"23a7c302-88f6-314c-a54c-b73adc86b091","product":{"name":"Flowise","vendor":{"name":"FlowiseAI"}},"product_version":"0 \u003c3.1.0"}],"enisaIdVendor":[{"id":"4f4a1a9d-76e6-32e1-82c9-fabc694c45db","vendor":{"name":"Flowise"}}],"enisaIdVulnerability":[{"id":"3dc8271d-ee4e-387e-8d2c-2f4633e5545a","vulnerability":{"id":"GHSA-jpvq-qwhh-pw47","description":"Flowise before 3.1.0 (affected versions 3.0.13 and earlier) uses weak hardcoded default JWT secrets (\u0027auth_token\u0027, \u0027refresh_token\u0027) and default audience and issuer values (\u0027AUDIENCE\u0027, \u0027ISSUER\u0027) in the enterprise passport authentication middleware (packages/server/src/enterprise/middleware/passport/index.ts). When the corresponding environment variables (JWT_AUTH_TOKEN_SECRET, JWT_REFRESH_TOKEN_SECRET, JWT_AUDIENCE, JWT_ISSUER) are not set, the application silently falls back to these publicly known defaults, allowing an attacker to forge valid JWTs and impersonate any user, including administrators, resulting in authentication bypass.","datePublished":"Jul 12, 2026, 12:31:48 PM","dateUpdated":"Jul 12, 2026, 12:31:48 PM","baseScore":0.0,"references":"https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-cc4f-hjpj-g9p8\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-56271\nhttps://www.vulncheck.com/advisories/flowise-weak-default-jwt-secrets-in-authentication-middleware\n","enisa_id":"EUVD-2026-43228\n","aliases":"CVE-2026-56271\nGHSA-jpvq-qwhh-pw47\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:02:28 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"8f306af9-6361-3dc6-8dd3-9cb3124df5e5","vulnerability":{"id":"CVE-2026-56271","description":"Flowise before 3.1.0 (affected versions 3.0.13 and earlier) uses weak hardcoded default JWT secrets (\u0027auth_token\u0027, \u0027refresh_token\u0027) and default audience and issuer values (\u0027AUDIENCE\u0027, \u0027ISSUER\u0027) in the enterprise passport authentication middleware (packages/server/src/enterprise/middleware/passport/index.ts). When the corresponding environment variables (JWT_AUTH_TOKEN_SECRET, JWT_REFRESH_TOKEN_SECRET, JWT_AUDIENCE, JWT_ISSUER) are not set, the application silently falls back to these publicly known defaults, allowing an attacker to forge valid JWTs and impersonate any user, including administrators, resulting in authentication bypass.","datePublished":"Jul 12, 2026, 12:06:32 PM","dateUpdated":"Jul 13, 2026, 3:41:09 PM","status":"PUBLISHED","baseScore":9.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-cc4f-hjpj-g9p8\nhttps://www.vulncheck.com/advisories/flowise-weak-default-jwt-secrets-in-authentication-middleware\n","enisa_id":"EUVD-2026-43228\n","assigner":"VulnCheck","epss":0.66,"dataProcessed":"Nov 1, 2026, 7:17:53 AM","vulnerabilityProduct":[{"id":"d9fa6b03-7520-3671-9de0-97b99b3ad818","product":{"name":"Flowise","vendor":{"name":"FlowiseAI"}},"product_version":"0 \u003c3.1.0"}],"vulnerabilityVendor":[{"id":"03acfc63-e2b8-346c-aa63-6dad7d209d31","vendor":{"name":"Flowise"}}]}}],"enisaIdAdvisory":[]}