CVE-2026-100607
Deferred Deferred - Pending Action

Authentication Bypass in Flowise via Email Spoofing

Publication date: 2026-09-26

Last updated on: 2026-09-26

Assigner: VulnCheck

Description
Flowise through 3.1.4 resolves SSO and local-password users solely by email without storing provider or subject identifier bindings, allowing attackers to authenticate as any existing user by claiming their email at any configured SSO provider. Attackers can gain complete account access including chatflows, credentials, and API keys by authenticating through a different SSO provider or local password than the victim's original registration method.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-26
Last Modified
2026-09-26
Generated
2026-09-26
AI Q&A
2026-09-26
EPSS Evaluated
N/A
NVD
CVE-2026-100607
EUVD
EUVD-2026-87702

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
flowise flowise 3.1.4
flowiseai flowise to 3.1.4 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-100607 is an authentication bypass vulnerability in Flowise through version 3.1.4. It allows attackers to take over user accounts by exploiting email-only Single Sign-On (SSO) matching. The system resolves user identities solely based on email addresses, ignoring provider-specific identifiers. This means an attacker can authenticate via any configured SSO provider or local password method using a victim's email, gaining full account access regardless of the victim's original registration method.

Detection Guidance

To detect this vulnerability, check if Flowise versions <= 3.1.4 are running and if user authentication relies solely on email matching without provider-specific bindings. Review SSO configuration files and logs for authentication attempts using mismatched providers for the same email.

Impact Analysis

If you use Flowise through 3.1.4, an attacker could impersonate your account by authenticating via any SSO provider or local password with your email. This grants them access to your chatflows, credentials, and API keys. The impact includes unauthorized data access, data theft, or misuse of your account for malicious purposes.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and access control. GDPR mandates strict authentication and authorization controls to protect personal data. HIPAA requires safeguards to ensure only authorized users access protected health information. The lack of proper SSO bindings and email-only authentication could lead to unauthorized access, resulting in non-compliance and potential legal consequences.

Mitigation Strategies

Immediately upgrade to a patched version if available. If no patch exists, implement a binding table to map each (provider, sub) pair to a Flowise user. Disable SSO providers with weak email verification policies and enforce strict email_verified claims validation in OIDC tokens.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100607. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart