NVD HIGH: CVE-2026-56270 — Flowise before 3.1.0 (versions 3.0.13 and earlier) contains a missing authentica...

Wednesday, June 24, 2026 at 01:16 PM UTC·Source: NIST NVD

Updated: Wednesday, June 24, 2026 at 05:00 PM UTC

Executive Summary

Analysis

Flowise before 3.1.0 (versions 3.0.13 and earlier) contains a missing authentication vulnerability in the /api/v1/loginmethod endpoint that allows unauthenticated users to retrieve an organization's complete SSO configuration, including OAuth client secrets in cleartext, by providing an organizationId parameter. Remote attackers can send a GET request to harvest sensitive API credentials for Google, Microsoft/Azure, GitHub, and Auth0 integrations. This affects FlowiseAI Cloud and self-hosted instances where the endpoint is exposed. CVSS Score: 7.5. Published: 2026-06-24T13:16:35.540.

Indicators of Compromise (1)

CVE (1)

CVE-2026-56270

NVD MITRE CVE

Source Attribution

Originally published by NIST NVD on Jun 24, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerability

CitrixBleed To Infinity And Beyond (Citrix NetScaler Pre-Auth Memory Overread CVE-2026-8451) - watchTowr Labs

[object Object]

CVE-2026-8451

1h agor/cybersecurity

CRITICALVulnerability

NVD CRITICAL: CVE-2026-58138 — Orkes Conductor 3.21.21 before 3.30.2 contains an unauthenticated remote code ex...

Orkes Conductor 3.21.21 before 3.30.2 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary OS commands by submitting inline workflow definitions containing malicious JavaScript or Python expressions to the workflow API endpoint prior to authentication. Attackers can exploit unsandboxed GraalVM evaluators configured with HostAccess.ALL or

CVE-2026-58138

1h agoNIST NVD

MEDIUMVulnerability

CIA chief highlights major shifts in agency’s tech approach

CIA Director John Ratcliffe said artificial intelligence capabilities are "akin to digital nuclear weapons.”

1h agoThe Record