identity-authentication-vulnerabilitydefault-credential-exposurewidely-deployed-product-advisory

Critical Flowise Authentication Bypass Lets Attackers Forge Admin JWTs

Vulnerability Disclosure · 4 sources · Updated 4mo ago · First seen Jul 12, 2026

A critical vulnerability tracked as CVE-2026-56271 allows remote attackers to bypass authentication in Flowise by forging valid JWTs and impersonating arbitrary users, including administrators. The flaw affects versions before 3.1.0, including 3.0.13 and earlier, and stems from weak hardcoded default JWT secrets plus default audience and issuer values in the enterprise passport authentication middleware.

When the relevant JWT environment variables are not explicitly configured, Flowise falls back to publicly known defaults, effectively embedding insecure default credentials into the authentication path. The issue is rated CVSS v3.1 9.8 and CVSS v4.0 9.3 as remotely exploitable, and remediation guidance calls for upgrading to Flowise 3.1.0 or later and setting strong, unique JWT secrets along with custom audience and issuer values.

Do you run this?See affected versions and whether adversaries are exploiting it.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

2 events · Jul 12, 2026

Jul 12, 20264mo ago
CVE-2026-56271 is publicly disclosed for Flowise
CVE-2026-56271 was publicly documented as a critical Flowise authentication bypass caused by weak hardcoded default JWT secrets and default audience and issuer values in enterprise passport authentication middleware. The disclosure notes remote exploitability and recommends upgrading to Flowise 3.1.0 or later with strong custom JWT settings.
CVE-2026-56271 - Flowise - Weak Default JWT Secrets in Authentication Middleware
Jul 12, 20264mo ago
Flowise fixes weak default JWT secret authentication bypass in 3.1.0
Flowise addressed a critical authentication bypass vulnerability by making the issue affect versions before 3.1.0, including 3.0.13 and earlier. The flaw allowed attackers to forge JWTs and impersonate arbitrary users when default JWT secret, audience, and issuer values were used.
CVE-2026-56271 - Flowise - Weak Default JWT Secrets in Authentication Middleware

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Vulnerabilities

1 linked

Authentication Bypass via Hardcoded JWT Secrets in Flowise Enterprise Passport Middleware (CVE-2026-56271)

Affected products

2 linked

FlowiseFlowise

Organizations

1 linked

Flowiseai

Do you run this?See whether adversaries are exploiting this yet, and where the affected versions run in your environment.

Check Your Exposure

Source coverage

Sources

4 references tracked. Mallory keeps watching after this page renders.

Threataft BlogNews · Jul 13, 2026

CVE-2026-56271 - Flowise Hardcoded JWT Secrets (CVSS 9.8) | ThreatAftOpen source ↗

Cvefeed High SeverityAdvisories · Jul 12, 2026

CVE-2026-56271 - Flowise - Weak Default JWT Secrets in Authentication MiddlewareOpen source ↗

CvereportsAdvisories · Jul 12, 2026

CVE-2026-56271: CVE-2026-56271: Authentication Bypass via Hardcoded JWT Secrets in Flowise Enterprise Passport Middleware | CVEReportsOpen source ↗

Vulncheck BlogNews · Jul 12, 2026

Flowise - Weak Default JWT Secrets in Authentication Middleware | Advisories | VulnCheckOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

← Back to News