{"id":"GHSA-8f47-4rh3-x44m","revision":"9626d1d138af48c0b2ac43ca38b75d8e","records":[{"revision":"9626d1d138af48c0b2ac43ca38b75d8e","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-8f47-4rh3-x44m","aliases":["CVE-2026-8026"],"title":"Flowise: Bcrypt Password Hash Exposure","description":"A security flaw has been discovered in FlowiseAI Flowise up to 3.0.12. Affected is the function Login of the file packages/server/src/enterprise/services/account.service.ts of the component API Response Handler. The manipulation results in information disclosure. The attack can be launched remotely. A high complexity level is associated with this attack. The exploitability is told to be difficult. You should upgrade the affected component.","state":0,"publishedAt":"2026-05-06T15:32:41+00:00","modifiedAt":"2026-05-12T22:41:26.113321+00:00","affected":[{"ecosystem":"npm","name":"flowise","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"last_affected","version":"3.0.12"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","score":null,"severity":null},{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://nvd.nist.gov/vuln/detail/CVE-2026-8026","https://gist.github.com/YLChen-007/50a553f09aa1c7c04ce18cec13986a91","https://github.com/FlowiseAI/Flowise","https://vuldb.com/submit/777656","https://vuldb.com/vuln/361273","https://vuldb.com/vuln/361273/cti"],"sourceUrl":"https://github.com/advisories/GHSA-8f47-4rh3-x44m","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-8f47-4rh3-x44m","identifiers":["GHSA-8f47-4rh3-x44m","CVE-2026-8026"]},"retained":false,"historicalAffected":[]}],"coverage":[]}