CVE-2026-56271: CVE-2026-56271: Authentication Bypass via Hardcoded JWT Secrets in Flowise Enterprise Passport Middleware

#security #cve #cybersecurity

CVE-2026-56271: Authentication Bypass via Hardcoded JWT Secrets in Flowise Enterprise Passport Middleware

Vulnerability ID: CVE-2026-56271
CVSS Score: 9.8
Published: 2026-07-12

CVE-2026-56271 represents a critical security flaw in Flowise, an open-source visual orchestration platform for Large Language Models (LLMs) and autonomous AI agents. The vulnerability occurs within the platform's enterprise passport authentication module, where default cryptographic parameters are used in the absence of explicit environment variables. Specifically, the middleware silently falls back to known, static hardcoded secrets ('auth_token' and 'refresh_token') and identifiers ('AUDIENCE' and 'ISSUER') to generate and verify session tokens. Consequently, remote unauthenticated attackers can construct arbitrary JSON Web Tokens (JWTs) signed with these hardcoded credentials to gain administrative entry to the application.

TL;DR

Flowise enterprise passport middleware silently falls back to hardcoded default JWT signing secrets and identifiers when configuration environment variables are left unset, enabling remote unauthenticated attackers to forge arbitrary tokens and take over administrator accounts.

Technical Details

CWE ID: CWE-321 / CWE-327
Attack Vector: Network
CVSS v3.1 Score: 9.8 (Critical)
CVSS v4.0 Score: 9.3 (Critical)
EPSS Score: 0.00376 (29.82 percentile)
Exploit Status: none
CISA KEV Status: Not Listed

Affected Systems

Flowise Enterprise Authentication Middleware
flowise: <= 3.0.13 (Fixed in: 3.1.0)

Mitigation Strategies

Upgrade Flowise to version 3.1.0 or later
Manually specify high-entropy JWT secrets in environment variables
Enforce strict validation of JWT audience and issuer parameters

Remediation Steps:

Identify running Flowise containers or deployments and check environment variables
Generate cryptographically secure keys (e.g., openssl rand -hex 32)
Update the .env configuration file or deployment manifest with the generated secrets for JWT_AUTH_TOKEN_SECRET and JWT_REFRESH_TOKEN_SECRET
Define custom values for JWT_AUDIENCE and JWT_ISSUER
Restart the Flowise server or container to apply modifications and invalidate any active sessions relying on default parameters