CVE-2026-56278

Received Received - Intake

BaseFortify

Publication date: 2026-06-30

Last updated on: 2026-06-30

Assigner: VulnCheck

Description

Flowise before 3.1.0 (affected versions 3.0.13 and earlier) uses a weak hardcoded default secret ('flowise') for the express-session middleware when the EXPRESS_SESSION_SECRET environment variable is not set (packages/server/src/enterprise/middleware/passport/index.ts). Because this default secret is publicly visible in the source code, an attacker can forge valid signed session cookies to impersonate any user and bypass authentication.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-30

Last Modified

2026-06-30

Generated

2026-07-01

AI Q&A

2026-07-01

EPSS Evaluated

N/A

NVD

CVE-2026-56278

EUVD

EUVD-2026-40433

Affected Vendors & Products

Vendor	Product	Version / Range
flowise	flowise	to 3.1.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-798	The product contains hard-coded credentials, such as a password or cryptographic key.

Attack-Flow Graph

Executive Summary

Flowise versions before 3.1.0 (specifically 3.0.13 and earlier) use a weak hardcoded default secret ('flowise') for the express-session middleware if the EXPRESS_SESSION_SECRET environment variable is not set.

Because this default secret is publicly visible in the source code, an attacker can exploit it by forging valid signed session cookies.

This allows the attacker to impersonate any user and bypass authentication mechanisms.

Impact Analysis

This vulnerability can have severe impacts as it allows attackers to bypass authentication and impersonate any user.

An attacker gaining unauthorized access could lead to data breaches, unauthorized actions within the application, and compromise of user accounts.

Mitigation Strategies

To mitigate this vulnerability, you should ensure that the EXPRESS_SESSION_SECRET environment variable is set to a strong, unique secret value instead of relying on the weak hardcoded default ('flowise').

Updating Flowise to a version later than 3.1.0, where this issue is fixed, is also recommended.

Hi! I’m here to help you understand CVE-2026-56278. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70