CVE-2026-56278

CRITICAL9.3

Flowise - Session Hijacking via Weak Default Express Session Secret

Published Jun 30, 2026

Modified 2 weeks ago

Details

Flowise before 3.1.0 (affected versions 3.0.13 and earlier) uses a weak hardcoded default secret ('flowise') for the express-session middleware when the EXPRESS_SESSION_SECRET environment variable is not set (packages/server/src/enterprise/middleware/passport/index.ts). Because this default secret is publicly visible in the source code, an attacker can forge valid signed session cookies to impersonate any user and bypass authentication.

References

ADVISORY

https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-2qqc-p94c-hxwh

ADVISORY

https://www.cve.org/CVERecord?id=CVE-2026-56278

ADVISORY

https://www.vulncheck.com/advisories/flowise-session-hijacking-via-weak-default-express-session-secret

CVSS Analysis

CVSS v4.0

9.3

Exploitability

Attack Vector