CVE-2026-100607

HIGHCVSS 7.7

Description

Flowise through 3.1.4 resolves SSO and local-password users solely by email without storing provider or subject identifier bindings, allowing attackers to authenticate as any existing user by claiming their email at any configured SSO provider. Attackers can gain complete account access including chatflows, credentials, and API keys by authenticating through a different SSO provider or local password than the victim's original registration method.

Timeline

Published:September 26th, 2026 2:16 PM

Last modified:September 28th, 2026 6:17 PM

CVSS Scoring

CVSS v3: 7.7 (HIGH)

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L

Weaknesses (CWE)

CWE-287

References & Reports

Advisories, patches, and third-party reports

https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-cffm-583c-vffr
https://www.vulncheck.com/advisories/flowise-through-3.1.4-authentication-bypass-via-email-only-sso
https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-cffm-583c-vffr

Source: NIST NVD · Data may lag official sources by up to one minute