Flowise through 3.1.4 resolves SSO and local-password users solely by email without storing...
zetlyn/cve-ghsa vulnerability ghsa GHSA-mjgh-prrr-9qw5 cve CVE-2026-100607 known 2026-09-26
https://github.com/advisories/GHSA-mjgh-prrr-9qw5
Properties
| cvss | 7.7receipt
This source has not kept a receipt for this claim yet. The next update that reads it will. |
|---|---|
| cwe | CWE-287receipt
This source has not kept a receipt for this claim yet. The next update that reads it will. |
| severity | critical GitHub's own rating, from the CVSS base score at 9.0 and above. receipt
This source has not kept a receipt for this claim yet. The next update that reads it will. |
Text
Flowise through 3.1.4 resolves SSO and local-password users solely by email without storing...
Flowise through 3.1.4 resolves SSO and local-password users solely by email without storing provider or subject identifier bindings, allowing attackers to authenticate as any existing user by claiming their email at any configured SSO provider. Attackers can gain complete account access including chatflows, credentials, and API keys by authenticating through a different SSO provider or local password than the victim's original registration method.