CRITICALVulnerability
Verified
Global

NVD CRITICAL: CVE-2026-56271 — Flowise before 3.1.0 (affected versions 3.0.13 and earlier) uses weak hardcoded ...

·Source: NIST NVD

Updated:

Executive Summary

Flowise before 3.1.0 (affected versions 3.0.13 and earlier) uses weak hardcoded default JWT secrets ('auth_token', 'refresh_token') and default audience and issuer values ('AUDIENCE', 'ISSUER') in the enterprise passport authentication middleware (packages/server/src/enterprise/middleware/passport/index.ts). When the corresponding environment variables (JWT_AUTH_TOKEN_SECRET, JWT_REFRESH_TOKEN_SEC

Analysis

Flowise before 3.1.0 (affected versions 3.0.13 and earlier) uses weak hardcoded default JWT secrets ('auth_token', 'refresh_token') and default audience and issuer values ('AUDIENCE', 'ISSUER') in the enterprise passport authentication middleware (packages/server/src/enterprise/middleware/passport/index.ts). When the corresponding environment variables (JWT_AUTH_TOKEN_SECRET, JWT_REFRESH_TOKEN_SECRET, JWT_AUDIENCE, JWT_ISSUER) are not set, the application silently falls back to these publicly known defaults, allowing an attacker to forge valid JWTs and impersonate any user, including administrators, resulting in authentication bypass. CVSS Score: 9.8. Published: 2026-07-12T12:16:45.290.

Indicators of Compromise (1)

CVE (1)
CVE-2026-56271
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Jul 12, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerability

KR: Military targeted in nearly 19,000 cyberattack attempts in 2025: lawmaker

Chae Yun-hwan reports: Cyberattack attempts against the South Korean military reached nearly 19,000 last year, marking the highest figure in five years, a lawmaker said Sunday. The military was targeted in 18,951 cyberattack attempts in 2025, compared with 11,700 in 2021, 9,115 in 2022, 13,599 in 2023 and 14,419 in 2024, according to Rep. Yu... Source

DataBreaches.net
CRITICALVulnerability

NVD CRITICAL: CVE-2026-56260 — Crawl4AI before 0.8.7 contains an arbitrary file write vulnerability in the Dock...

Crawl4AI before 0.8.7 contains an arbitrary file write vulnerability in the Docker API server's /screenshot and /pdf endpoints. The output_path parameter accepts arbitrary filesystem paths without validation, allowing an attacker to supply absolute or path-traversal values to write to any location writable by the application's user, overwriting server files and causing denial of service.

CVE-2026-56260
NIST NVD
LOWVulnerability

Dell BIOS Passwords: Weak XOR Encryption Allows Recovery from SPI Flash (CVE-2026-40639)

[object Object]

CVE-2026-40639
r/blueteamsec