by Kastro
Paper/Archive/CVE-2026-100607

CVE-2026-100607

FlowiseAI Flowise — Flowise through 3.1.4 Authentication Bypass via Email-Only SSO

EPSS 0.4%public exploitCVSS 9.2
critical.is priorityof 100
44
CVSS 9.2 (CNA)9.2 / 10 × 3027.6Not in CISA KEV+300.0EPSS percentile 30.3.303 × 206.1Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

Flowise through 3.1.4 resolves SSO and local-password users solely by email without storing provider or subject identifier bindings, allowing attackers to authenticate as any existing user by claiming their email at any configured SSO provider. Attackers can gain complete account access including chatflows, credentials, and API keys by authenticating through a different SSO provider or local password than the victim's original registration method.

Affected

ProductAffectedFixed inSource
Flowise≤ 3.1.4–CNA

Scores by source

VulnCheck (CNA)9.2CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
VulnCheck (CNA)7.7CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

exploitgithub.com/FlowiseAI/Flowise/security/advisories/GHSA-cffm-583c-vffrwriteupvulncheck.com/advisories/flowise-through-3.1.4-authentication-bypass-via-email-only-sso