Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Flowise before 3.1.0 (affected versions 3.0.13 and earlier) uses weak hardcoded default JWT secrets ('auth_token', 'refresh_token') and default audience and issuer values ('AUDIENCE', 'ISSUER') in the enterprise passport authentication middleware (packages/server/src/enterprise/middleware/passport/index.ts). When the corresponding environment variables (JWT_AUTH_TOKEN_SECRET, JWT_REFRESH_TOKEN_SECRET, JWT_AUDIENCE, JWT_ISSUER) are not set, the application silently falls back to these publicly known defaults, allowing an attacker to forge valid JWTs and impersonate any user, including administrators, resulting in authentication bypass.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-07-12 | 5 | Disclosure2General1Patch2 |
| 2026-07-13 | 2 | Disclosure2 |
ARETIQ Daily Vulnerability Bulletin — July 12, 2026 🔴 CRITICAL: CVE-2026-56271 (flowise/flowise) AAS 13.0 4 vulnerabilities — CRITICAL: 1, HIGH: 3 Full bulletin: https://aretiq.ai/bulletins/2026-07-12/
Post summary
The bulletin announces CVE‑2026‑56271 as a critical vulnerability but does not provide any technical details, exploit code, or remediation information.
Warning: Critical Authentication Bypass in #Flowise. #CVE-2026-56271 CVSS: 9.8. This vulnerability lets attackers forge admin JWTs via hardcoded secrets for full account takeover. #Patch #Patch #Patch
Post summary
The post warns of a critical authentication bypass (CVE‑2026‑56271) in Flowise, CVSS 9.8, where attackers can forge admin JWTs using hardcoded secrets for full account takeover.
🚨 CRITICAL - Flowise hardcoded JWT defaults allow token forgery auth bypass (CVE-2026-56271) Flowise before 3.1.0 is vulnerable in its enterprise passport authentication middleware due to weak hardcoded default JWT secrets and default audience/issuer values used when environment variables aren’t set. The root cause is insecure defaults and improper authentication configuration handling that silently falls back to publicly known values. An attacker can exploit this remotely by forging valid JWTs that match the default secret/audience/issuer, requiring no prior credentials if the deployment is using the defaults. Impact is full authentication bypass and account impersonation up to admin, enabling complete takeover of the Flowise instance and access to sensitive data and workflows. 👉 Affected: flowise < 3.1.0 | Upgrade to 3.1.0
Post summary
Flowise versions before 3.1.0 are vulnerable to authentication bypass via hardcoded JWT defaults; upgrading to 3.1.0 patches the flaw. No proof-of-concept, active exploitation, or debunking is reported.
🚨 CVE-2026-56271 — CVSS 9.8/10 ██████████ Flowise before 3.1.0 (affected versions 3.0.13 and earlier) uses weak hardcoded default JWT secrets ('auth_token',... Severity: CRITICAL Patch now. #cybersecurity #CVE https://t.co/BXzLBpZCKT
Post summary
The tweet announces CVE-2026-56271 with a critical CVSS score and weak hardcoded JWT secrets, and it states a patch is now available.
🚨 CRITICAL: CVE-2026-56271 — Flowise Hardcoded JWT Secrets CVSS 9.8. Default secrets 'auth_token' and 'refresh_token' allow unauthenticated attackers to forge JWTs and impersonate admins. Patch to 3.1.0 NOW. → http://threataft.com/articles/cve-2026-56271-flowise-hardcoded-jwt-secrets #cybersecurity #infosec #AISecurity
Post summary
The post announces CVE‑2026‑56271, explains the hardcoded JWT secret flaw, provides a CVSS score and a patch version, but does not share exploit code or evidence of active exploitation.
🚨*CVE* CVE-2026-56271 Flowise before 3.1.0 (affected versions 3.0.13 and earlier) uses weak hardcoded default JWT secrets ('auth_token', 'refresh_token') and default audience and issuer va… https://www.cve.org/CVERecord?id=CVE-2026-56271 ----- Traducción: CVE-2026-56271 Flo… http://infoflow.cloud`
Post summary
CVE-2026-56271 is disclosed as a Flowise vulnerability involving weak hardcoded JWT secrets, with affected versions identified, but no PoC, exploit, patch, or active exploitation information is provided.
CVE-2026-56271 Flowise before 3.1.0 (affected versions 3.0.13 and earlier) uses weak hardcoded default JWT secrets ('auth_token', 'refresh_token') and default audience and issuer va… https://www.cve.org/CVERecord?id=CVE-2026-56271
Post summary
The excerpt highlights that Flowise versions prior to 3.1.0 use weak hardcoded default JWT secrets, exposing them to credential compromise.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | flowiseai | flowise | - | - | - |