CVE-2026-56271— Flowise - Weak Default JWT Secrets in Authentication Middleware
Possible ATT&CK Techniques 3AI
T1078 · Valid Accounts T1110 · Brute Force T1190 · Exploit Public-Facing ApplicationGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-56271
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Flowise - Weak Default JWT Secrets in Authentication Middleware
Source: CVE Program / CVE List V5
Vulnerability Description
Flowise before 3.1.0 (affected versions 3.0.13 and earlier) uses weak hardcoded default JWT secrets ('auth_token', 'refresh_token') and default audience and issuer values ('AUDIENCE', 'ISSUER') in the enterprise passport authentication middleware (packages/server/src/enterprise/middleware/passport/index.ts). When the corresponding environment variables (JWT_AUTH_TOKEN_SECRET, JWT_REFRESH_TOKEN_SECRET, JWT_AUDIENCE, JWT_ISSUER) are not set, the application silently falls back to these publicly known defaults, allowing an attacker to forge valid JWTs and impersonate any user, including administrators, resulting in authentication bypass.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
使用硬编码的密码学密钥
Source: CVE Program / CVE List V5
Vulnerability Title
FlowiseAI Flowise 加密问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
FlowiseAI Flowise是FlowiseAI公司开源的一个用于轻松构建 LLM 应用程序的工具。 FlowiseAI Flowise 3.0.13及之前版本存在加密问题漏洞，该漏洞源于在企业护照认证中间件中使用弱硬编码默认JWT密钥和默认观众及发行者值，当未设置对应环境变量时，应用静默回退到这些公共已知默认值，允许攻击者伪造有效JWT并冒充任意用户（包括管理员），导致认证绕过。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-56271
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
Qwen3.6-35B-A3B · 5794 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month
III. Intelligence Information for CVE-2026-56271
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-56271 (1)
Other References for CVE-2026-56271 (1)
IV. Related Vulnerabilities
Same product: Flowise
- CVE-2026-73604
Flowise before 3.1.3 Credential Exposure via API - CVE-2026-73603
Flowise before 3.1.4 Credential Abuse via Text-to-Speech - CVE-2026-73602
Flowise before 3.1.3 Sandbox Escape to RCE - CVE-2026-73601
Flowise before 3.1.3 Remote Code Execution via Custom MCP - CVE-2026-73487
Flowise before 3.1.3 Prompt Injection RCE via CSV Agent
Same vendor: Flowise
- CVE-2026-56273
Flowise - Path Traversal in Vector Store basePath Parameter - CVE-2026-56278
Flowise - Session Hijacking via Weak Default Express Session - CVE-2026-56277
Flowise - Hardcoded CORS Wildcard in TTS Endpoint - CVE-2026-58057
Flowise - Custom MCP Environment Variable Denylist Bypass vi - CVE-2025-71336
Flowise - Unsandboxed Remote Code Execution via Custom MCP
Same weakness: CWE-321
V. Comments for CVE-2026-56271
No comments yet