PT-2026-54029 · Flowise · Flowise

Kolega-Ai-Dev · Published 2026-06-30 · Updated 2026-06-30 · CVE-2026-56278

NVD

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Flowise before 3.1.0 (affected versions 3.0.13 and earlier) uses a weak hardcoded default secret ('flowise') for the express-session middleware when the EXPRESS SESSION SECRET environment variable is not set (packages/server/src/enterprise/middleware/passport/index.ts). Because this default secret is publicly visible in the source code, an attacker can forge valid signed session cookies to impersonate any user and bypass authentication.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2026-56278

Affected Products

Flowise

References · 3

• https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-2qqc-p94c-hxwh · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-56278 · Security Note
• https://vulncheck.com/advisories/flowise-session-hijacking-via-weak-default-express-session-secret · Note