Flowise through 3.1.4 resolves SSO and local-password users solely by email without storing...

zetlyn/cve-ghsa vulnerability ghsa GHSA-mjgh-prrr-9qw5 cve CVE-2026-100607 known 2026-09-26

https://github.com/advisories/GHSA-mjgh-prrr-9qw5

Properties

cvss

cvss	7.7 receipt Source GitHub advisories Its words `7.7` Read by `field:cvss.score` Said since 2026-09-28 11:44 UTC Last answered 2026-10-06 13:46 UTC Original open at the source What the source handed over { "credits": [], "cve_id": "CVE-2026-100607", "cvss": { "score": 7.7, "vector_string": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L" }, "cvss_severities": { "cvss_v3": { "score": 7.7, "vector_string": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L" }, "cvss_v4": { "score": 9.2, "vector_string": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" } }, "cwes": [ { "cwe_id": "CWE-287", "name": "Improper Authentication" } ], "description": "Flowise through 3.1.4 resolves SSO and local-password users solely by email without storing provider or subject identifier bindings, allowing attackers to authenticate as any existing user by claiming their email at any configured SSO provider. Attackers can gain complete account access including chatflows, credentials, and API keys by authenticating through a different SSO provider or local password than the victim's original registration method.", "epss": { "percentage": 0.00288, "percentile": 0.19211 }, "ghsa_id": "GHSA-mjgh-prrr-9qw5", "github_reviewed_at": null, "html_url": "https://github.com/advisories/GHSA-mjgh-prrr-9qw5", "identifiers": [ { "type": "GHSA", "value": "GHSA-mjgh-prrr-9qw5" }, { "type": "CVE", "value": "CVE-2026-100607" } ], "nvd_published_at": "2026-09-26T14:16:40Z", "published_at": "2026-09-26T15:31:13Z", "references": [ "https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-cffm-583c-vffr", "https://nvd.nist.gov/vuln/detail/CVE-2026-100607", "https://www.vulncheck.com/advisories/flowise-through-3.1.4-authentication-bypass-via-email-only-sso", "https://github.com/advisories/GHSA-mjgh-prrr-9qw5" ], "repository_advisory_url": null, "severity": "critical", "source_code_location": "", "summary": "Flowise through 3.1.4 resolves SSO and local-password users solely by email without storing...", "type": "unreviewed", "updated_at": "2026-09-26T15:31:21Z", "url": "https://api.github.com/advisories/GHSA-mjgh-prrr-9qw5", "vulnerabilities": [], "withdrawn_at": null }
cwe	CWE-287 receipt Source GitHub advisories Its words `CWE-287` Read by `field:cwes[].cwe_id` Said since 2026-09-28 11:44 UTC Last answered 2026-10-06 13:46 UTC Original open at the source What the source handed over { "credits": [], "cve_id": "CVE-2026-100607", "cvss": { "score": 7.7, "vector_string": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L" }, "cvss_severities": { "cvss_v3": { "score": 7.7, "vector_string": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L" }, "cvss_v4": { "score": 9.2, "vector_string": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" } }, "cwes": [ { "cwe_id": "CWE-287", "name": "Improper Authentication" } ], "description": "Flowise through 3.1.4 resolves SSO and local-password users solely by email without storing provider or subject identifier bindings, allowing attackers to authenticate as any existing user by claiming their email at any configured SSO provider. Attackers can gain complete account access including chatflows, credentials, and API keys by authenticating through a different SSO provider or local password than the victim's original registration method.", "epss": { "percentage": 0.00288, "percentile": 0.19211 }, "ghsa_id": "GHSA-mjgh-prrr-9qw5", "github_reviewed_at": null, "html_url": "https://github.com/advisories/GHSA-mjgh-prrr-9qw5", "identifiers": [ { "type": "GHSA", "value": "GHSA-mjgh-prrr-9qw5" }, { "type": "CVE", "value": "CVE-2026-100607" } ], "nvd_published_at": "2026-09-26T14:16:40Z", "published_at": "2026-09-26T15:31:13Z", "references": [ "https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-cffm-583c-vffr", "https://nvd.nist.gov/vuln/detail/CVE-2026-100607", "https://www.vulncheck.com/advisories/flowise-through-3.1.4-authentication-bypass-via-email-only-sso", "https://github.com/advisories/GHSA-mjgh-prrr-9qw5" ], "repository_advisory_url": null, "severity": "critical", "source_code_location": "", "summary": "Flowise through 3.1.4 resolves SSO and local-password users solely by email without storing...", "type": "unreviewed", "updated_at": "2026-09-26T15:31:21Z", "url": "https://api.github.com/advisories/GHSA-mjgh-prrr-9qw5", "vulnerabilities": [], "withdrawn_at": null }
severity	critical GitHub's own rating, from the CVSS base score at 9.0 and above. receipt Source GitHub advisories Its words `critical` Read by `field:severity` Said since 2026-09-28 11:44 UTC Last answered 2026-10-06 13:46 UTC Original open at the source What the source handed over { "credits": [], "cve_id": "CVE-2026-100607", "cvss": { "score": 7.7, "vector_string": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L" }, "cvss_severities": { "cvss_v3": { "score": 7.7, "vector_string": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L" }, "cvss_v4": { "score": 9.2, "vector_string": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" } }, "cwes": [ { "cwe_id": "CWE-287", "name": "Improper Authentication" } ], "description": "Flowise through 3.1.4 resolves SSO and local-password users solely by email without storing provider or subject identifier bindings, allowing attackers to authenticate as any existing user by claiming their email at any configured SSO provider. Attackers can gain complete account access including chatflows, credentials, and API keys by authenticating through a different SSO provider or local password than the victim's original registration method.", "epss": { "percentage": 0.00288, "percentile": 0.19211 }, "ghsa_id": "GHSA-mjgh-prrr-9qw5", "github_reviewed_at": null, "html_url": "https://github.com/advisories/GHSA-mjgh-prrr-9qw5", "identifiers": [ { "type": "GHSA", "value": "GHSA-mjgh-prrr-9qw5" }, { "type": "CVE", "value": "CVE-2026-100607" } ], "nvd_published_at": "2026-09-26T14:16:40Z", "published_at": "2026-09-26T15:31:13Z", "references": [ "https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-cffm-583c-vffr", "https://nvd.nist.gov/vuln/detail/CVE-2026-100607", "https://www.vulncheck.com/advisories/flowise-through-3.1.4-authentication-bypass-via-email-only-sso", "https://github.com/advisories/GHSA-mjgh-prrr-9qw5" ], "repository_advisory_url": null, "severity": "critical", "source_code_location": "", "summary": "Flowise through 3.1.4 resolves SSO and local-password users solely by email without storing...", "type": "unreviewed", "updated_at": "2026-09-26T15:31:21Z", "url": "https://api.github.com/advisories/GHSA-mjgh-prrr-9qw5", "vulnerabilities": [], "withdrawn_at": null }

7.7

receipt

Source: GitHub advisories
Its words: 7.7
Read by: field:cvss.score
Said since: 2026-09-28 11:44 UTC
Last answered: 2026-10-06 13:46 UTC
Original: open at the source

What the source handed over

{
  "credits": [],
  "cve_id": "CVE-2026-100607",
  "cvss": {
    "score": 7.7,
    "vector_string": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L"
  },
  "cvss_severities": {
    "cvss_v3": {
      "score": 7.7,
      "vector_string": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L"
    },
    "cvss_v4": {
      "score": 9.2,
      "vector_string": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
    }
  },
  "cwes": [
    {
      "cwe_id": "CWE-287",
      "name": "Improper Authentication"
    }
  ],
  "description": "Flowise through 3.1.4 resolves SSO and local-password users solely by email without storing provider or subject identifier bindings, allowing attackers to authenticate as any existing user by claiming their email at any configured SSO provider. Attackers can gain complete account access including chatflows, credentials, and API keys by authenticating through a different SSO provider or local password than the victim's original registration method.",
  "epss": {
    "percentage": 0.00288,
    "percentile": 0.19211
  },
  "ghsa_id": "GHSA-mjgh-prrr-9qw5",
  "github_reviewed_at": null,
  "html_url": "https://github.com/advisories/GHSA-mjgh-prrr-9qw5",
  "identifiers": [
    {
      "type": "GHSA",
      "value": "GHSA-mjgh-prrr-9qw5"
    },
    {
      "type": "CVE",
      "value": "CVE-2026-100607"
    }
  ],
  "nvd_published_at": "2026-09-26T14:16:40Z",
  "published_at": "2026-09-26T15:31:13Z",
  "references": [
    "https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-cffm-583c-vffr",
    "https://nvd.nist.gov/vuln/detail/CVE-2026-100607",
    "https://www.vulncheck.com/advisories/flowise-through-3.1.4-authentication-bypass-via-email-only-sso",
    "https://github.com/advisories/GHSA-mjgh-prrr-9qw5"
  ],
  "repository_advisory_url": null,
  "severity": "critical",
  "source_code_location": "",
  "summary": "Flowise through 3.1.4 resolves SSO and local-password users solely by email without storing...",
  "type": "unreviewed",
  "updated_at": "2026-09-26T15:31:21Z",
  "url": "https://api.github.com/advisories/GHSA-mjgh-prrr-9qw5",
  "vulnerabilities": [],
  "withdrawn_at": null
}

cwe

CWE-287

receipt

Source: GitHub advisories
Its words: CWE-287
Read by: field:cwes[].cwe_id
Said since: 2026-09-28 11:44 UTC
Last answered: 2026-10-06 13:46 UTC
Original: open at the source

What the source handed over

{
  "credits": [],
  "cve_id": "CVE-2026-100607",
  "cvss": {
    "score": 7.7,
    "vector_string": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L"
  },
  "cvss_severities": {
    "cvss_v3": {
      "score": 7.7,
      "vector_string": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L"
    },
    "cvss_v4": {
      "score": 9.2,
      "vector_string": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
    }
  },
  "cwes": [
    {
      "cwe_id": "CWE-287",
      "name": "Improper Authentication"
    }
  ],
  "description": "Flowise through 3.1.4 resolves SSO and local-password users solely by email without storing provider or subject identifier bindings, allowing attackers to authenticate as any existing user by claiming their email at any configured SSO provider. Attackers can gain complete account access including chatflows, credentials, and API keys by authenticating through a different SSO provider or local password than the victim's original registration method.",
  "epss": {
    "percentage": 0.00288,
    "percentile": 0.19211
  },
  "ghsa_id": "GHSA-mjgh-prrr-9qw5",
  "github_reviewed_at": null,
  "html_url": "https://github.com/advisories/GHSA-mjgh-prrr-9qw5",
  "identifiers": [
    {
      "type": "GHSA",
      "value": "GHSA-mjgh-prrr-9qw5"
    },
    {
      "type": "CVE",
      "value": "CVE-2026-100607"
    }
  ],
  "nvd_published_at": "2026-09-26T14:16:40Z",
  "published_at": "2026-09-26T15:31:13Z",
  "references": [
    "https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-cffm-583c-vffr",
    "https://nvd.nist.gov/vuln/detail/CVE-2026-100607",
    "https://www.vulncheck.com/advisories/flowise-through-3.1.4-authentication-bypass-via-email-only-sso",
    "https://github.com/advisories/GHSA-mjgh-prrr-9qw5"
  ],
  "repository_advisory_url": null,
  "severity": "critical",
  "source_code_location": "",
  "summary": "Flowise through 3.1.4 resolves SSO and local-password users solely by email without storing...",
  "type": "unreviewed",
  "updated_at": "2026-09-26T15:31:21Z",
  "url": "https://api.github.com/advisories/GHSA-mjgh-prrr-9qw5",
  "vulnerabilities": [],
  "withdrawn_at": null
}

severity

critical

GitHub's own rating, from the CVSS base score at 9.0 and above.

receipt

Source: GitHub advisories
Its words: critical
Read by: field:severity
Said since: 2026-09-28 11:44 UTC
Last answered: 2026-10-06 13:46 UTC
Original: open at the source

What the source handed over

{
  "credits": [],
  "cve_id": "CVE-2026-100607",
  "cvss": {
    "score": 7.7,
    "vector_string": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L"
  },
  "cvss_severities": {
    "cvss_v3": {
      "score": 7.7,
      "vector_string": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L"
    },
    "cvss_v4": {
      "score": 9.2,
      "vector_string": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
    }
  },
  "cwes": [
    {
      "cwe_id": "CWE-287",
      "name": "Improper Authentication"
    }
  ],
  "description": "Flowise through 3.1.4 resolves SSO and local-password users solely by email without storing provider or subject identifier bindings, allowing attackers to authenticate as any existing user by claiming their email at any configured SSO provider. Attackers can gain complete account access including chatflows, credentials, and API keys by authenticating through a different SSO provider or local password than the victim's original registration method.",
  "epss": {
    "percentage": 0.00288,
    "percentile": 0.19211
  },
  "ghsa_id": "GHSA-mjgh-prrr-9qw5",
  "github_reviewed_at": null,
  "html_url": "https://github.com/advisories/GHSA-mjgh-prrr-9qw5",
  "identifiers": [
    {
      "type": "GHSA",
      "value": "GHSA-mjgh-prrr-9qw5"
    },
    {
      "type": "CVE",
      "value": "CVE-2026-100607"
    }
  ],
  "nvd_published_at": "2026-09-26T14:16:40Z",
  "published_at": "2026-09-26T15:31:13Z",
  "references": [
    "https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-cffm-583c-vffr",
    "https://nvd.nist.gov/vuln/detail/CVE-2026-100607",
    "https://www.vulncheck.com/advisories/flowise-through-3.1.4-authentication-bypass-via-email-only-sso",
    "https://github.com/advisories/GHSA-mjgh-prrr-9qw5"
  ],
  "repository_advisory_url": null,
  "severity": "critical",
  "source_code_location": "",
  "summary": "Flowise through 3.1.4 resolves SSO and local-password users solely by email without storing...",
  "type": "unreviewed",
  "updated_at": "2026-09-26T15:31:21Z",
  "url": "https://api.github.com/advisories/GHSA-mjgh-prrr-9qw5",
  "vulnerabilities": [],
  "withdrawn_at": null
}

Text

Flowise through 3.1.4 resolves SSO and local-password users solely by email without storing... Flowise through 3.1.4 resolves SSO and local-password users solely by email without storing provider or subject identifier bindings, allowing attackers to authenticate as any existing user by claiming their email at any configured SSO provider. Attackers can gain complete account access including chatflows, credentials, and API keys by authenticating through a different SSO provider or local password than the victim's original registration method.