CVE-2026-56278

CriticalCVSS 9.1/10Last modified Jul 6, 2026

Description

Flowise before 3.1.0 (affected versions 3.0.13 and earlier) uses a weak hardcoded default secret ('flowise') for the express-session middleware when the EXPRESS_SESSION_SECRET environment variable is not set (packages/server/src/enterprise/middleware/passport/index.ts). Because this default secret is publicly visible in the source code, an attacker can forge valid signed session cookies to impersonate any user and bypass authentication.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-798

Affected software

No affected versions have been published.

Timeline

Published: Jun 30, 2026
Last modified: Jul 6, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-562797.5Capgo before 12.128.2 contains an information disclosure vulnerability in the get_orgs_v7(userid) RPC function that remains publicly invokab CVE-2026-56288.8A security vulnerability has been detected in Belkin F9K1015 1.00.10. Impacted is the function formSetSystemSettings of the file /goform/for CVE-2026-562807.1Cap-go before 12.128.2 contains a privilege inversion vulnerability in GET /build/logs/:jobId that allows read-only API key holders to cance CVE-2026-562813.8Capgo before 12.128.2 contains a sql injection vulnerability in the POST /private/admin_stats endpoint where the limit parameter is destruct CVE-2026-562825.3Capgo before 12.128.2 contains an information disclosure vulnerability in the unauthenticated /replication endpoint that exposes internal Po CVE-2026-562835.4Capgo before 12.128.2 contains an html injection vulnerability in the organization settings endpoint that allows attackers to inject malicio CVE-2026-562845.3Capgo (Cap-go/capgo) before 12.128.2 contains an information disclosure vulnerability in the Supabase PostgREST RPC function public.get_tota CVE-2026-562858.6Nitter's /video media proxy endpoint fails to validate target URLs against Twitter/X domains and uses a hardcoded default HMAC key, allowing CVE-2026-562868.1Capgo before 12.128.2 contains an authentication bypass vulnerability in the account deletion endpoint that allows deletion without password CVE-2026-562878.1A boolean-based SQL Injection vulnerability exists in Apache Fineract's Client Search API (GET /api/v1/clients) in versions up to and includ CVE-2026-562885.5GNU patch is vulnerable to a NULL pointer dereference when processing a specially crafted unified-diff patch file. Improper handling of cons CVE-2026-562895.5GNU patch is vulnerable to a denial of service (DoS) due to improper validation of hunk (single block of changes in diff) line offsets in un