CRITICALVulnerability
Verified
Global

NVD CRITICAL: CVE-2026-56278 — Flowise before 3.1.0 (affected versions 3.0.13 and earlier) uses a weak hardcode...

·Source: NIST NVD

Updated:

Executive Summary

Flowise before 3.1.0 (affected versions 3.0.13 and earlier) uses a weak hardcoded default secret ('flowise') for the express-session middleware when the EXPRESS_SESSION_SECRET environment variable is not set (packages/server/src/enterprise/middleware/passport/index.ts). Because this default secret is publicly visible in the source code, an attacker can forge valid signed session cookies to imperso

Analysis

Flowise before 3.1.0 (affected versions 3.0.13 and earlier) uses a weak hardcoded default secret ('flowise') for the express-session middleware when the EXPRESS_SESSION_SECRET environment variable is not set (packages/server/src/enterprise/middleware/passport/index.ts). Because this default secret is publicly visible in the source code, an attacker can forge valid signed session cookies to impersonate any user and bypass authentication. CVSS Score: 9.1. Published: 2026-06-30T23:17:29.610.

Indicators of Compromise (1)

CVE (1)
CVE-2026-56278
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Jun 30, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerabilityNEW

The Payments Association names Renuka Rawlins director of policy and government affairs

The Payments Association, a trade body for the payments sector, has appointed Renuka Rawlins as its new Director of Policy & Government Affairs.

Finextra
MEDIUMVulnerabilityNEW

Azure CLI Password Spray Hits at Least 78 Microsoft Accounts in 81M+ Attempts

Cybersecurity researchers have warned of a "massive, ongoing, automated password spray attack" aimed at Microsoft's Azure command-line interface (CLI), compromising dozens of accounts in the process. The activity, per Huntress, originates from an IPv6 address range (2a0a:d683::/32) controlled by internet infrastructure provider LSHIY LLC (AS32167). "Between June 12 and June 26, the threat

The Hacker News
CRITICALVulnerability

NVD CRITICAL: CVE-2026-6070 — The WP-BusinessDirectory plugin for WordPress is vulnerable to Unauthenticated A...

The WP-BusinessDirectory plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Deletion in versions up to and including 4.0.1. This is due to insufficient path validation in the remove() method of the JBusinessDirectoryControllerUpload class. The task=upload.remove endpoint is accessible without authentication via the plugin's frontend routing system. The _filename parameter is acce

CVE-2026-6070
NIST NVD