Critical JWT Secret Vulnerability in Flowise: Weak Defaults Allow User Impersonation
Summary
GHSA-cc4f-hjpj-g9p8: Flowise: Weak Default JWT Secrets. Affects flowise versions < 3.1.0. Fixed in 3.1.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Flowise is an open-source application designed for building and deploying machine learning workflows. It provides a user-friendly interface and integrates various data processing tools. However, it has been found to have a critical vulnerability related to its handling of JSON Web Tokens (JWTs), specifically the use of weak default secrets for authentication.
Vulnerability Detail
The vulnerability arises from hardcoded default values for JWT secrets in the Flowise application. These defaults ('auth_token', 'refresh_token', 'AUDIENCE', 'ISSUER') are weak and easily guessable. If an administrator deploys the application without setting the necessary environment variables, the application will revert to these insecure defaults. This allows attackers to forge valid JWTs, impersonate any user, and potentially gain unauthorized access to protected endpoints, including administrative functions. The fallback mechanism where the refresh token shares the same secret as the authentication token further exacerbates the risk, leading to a complete authentication bypass.
How To Fix
Latest published version: 3.1.4 as of 22 Oct 2026
npm install flowise@3.1.4Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.1.0
This is the first release that contains the fix.
npm install flowise@3.1.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that the application is not deployed without setting the necessary environment variables. Additionally, consider implementing a monitoring solution like Vulert, which can alert you to vulnerabilities in real-time without requiring code access. You can check if your application is affected by this vulnerability using the Vulert playground at https://vulert.com/scanner.
Conclusion
The Flowise application has a critical vulnerability due to weak default JWT secrets that can lead to severe security risks, including user impersonation and authentication bypass. It is essential to update to the latest version and configure strong secrets to mitigate this risk.
See every vulnerability recorded for flowise →
FAQ
The vulnerability is due to weak default JWT secrets that can be exploited to forge valid tokens and impersonate users.
You can use the Vulert playground at Vulert Scanner to check for vulnerabilities in your application without signing up.
Attackers can bypass authentication, impersonate any user, and gain unauthorized access to sensitive areas of the application.
Yes, updating the Flowise package to version 3.1.0 or later addresses this vulnerability.
Ensure that the necessary JWT environment variables are set and consider using monitoring tools like Vulert to stay informed about vulnerabilities.
References
Related vulnerabilities
Recent vulnerabilities recorded for flowise.
