CVE-2026-56271: Flowise - Weak Default JWT Secrets in Authentication Middleware
Flowise before 3.1.0 (affected versions 3.0.13 and earlier) uses weak hardcoded default JWT secrets ('authtoken', 'refreshtoken') and default audience and issuer values ('AUDIENCE', 'ISSUER') in the enterprise passport authentication middleware (packages/server/src/enterprise/middleware/passport/index.ts). When the corresponding environment variables (JWTAUTHTOKENSECRET, JWTREFRESHTOKENSECRET, JWTAUDIENCE, JWTISSUER) are not set, the application silently falls back to these publicly known defaults, allowing an attacker to forge valid JWTs and impersonate any user, including administrators, resulting in authentication bypass.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
flowiseto a version that resolves this vulnerability.Fixed in 3.1.0 - Configuration
Set JWT_AUTH_TOKEN_SECRET in the environment so Flowise does not use the publicly known hardcoded default 'auth_token'.
Flowise enterprise passport authentication middleware (packages/server/src/enterprise/middleware/passport/index.ts) JWT_AUTH_TOKEN_SECRET = Set to a strong, unpredictable value (so it does not fall back to the weak default 'auth_token') - Configuration
Set JWT_REFRESH_TOKEN_SECRET in the environment so Flowise does not use the publicly known hardcoded default 'refresh_token'.
Flowise enterprise passport authentication middleware (packages/server/src/enterprise/middleware/passport/index.ts) JWT_REFRESH_TOKEN_SECRET = Set to a strong, unpredictable value (so it does not fall back to the weak default 'refresh_token') - Configuration
Set JWT_AUDIENCE in the environment so Flowise does not use the publicly known default value 'AUDIENCE'.
Flowise enterprise passport authentication middleware (packages/server/src/enterprise/middleware/passport/index.ts) JWT_AUDIENCE = Set to the intended audience value (so it does not fall back to default 'AUDIENCE') - Configuration
Set JWT_ISSUER in the environment so Flowise does not use the publicly known default value 'ISSUER'.
Flowise enterprise passport authentication middleware (packages/server/src/enterprise/middleware/passport/index.ts) JWT_ISSUER = Set to the intended issuer value (so it does not fall back to default 'ISSUER')
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56271?
The severity of CVE-2026-56271 is critical, rated at 9.8.
How do I fix CVE-2026-56271?
To fix CVE-2026-56271, upgrade Flowise to version 3.1.0 or later.
What are the implications of CVE-2026-56271?
CVE-2026-56271 allows attackers to potentially exploit weak default JWT secrets, compromising the authentication process.
Which versions of Flowise are affected by CVE-2026-56271?
Versions 3.0.13 and earlier of Flowise are affected by CVE-2026-56271.
What components are involved in CVE-2026-56271?
CVE-2026-56271 specifically affects the enterprise passport authentication middleware in Flowise.