CVE-2026-56271

{
  "etk_id": "ETK-2026-31",
  "cve_id": "CVE-2026-56271",
  "display_id": "CVE-2026-56271",
  "ghsa_id": "GHSA-jpvq-qwhh-pw47",
  "euvd_id": "EUVD-2026-43228",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Hardcoded JWT defaults enable authentication bypass in Flowise",
  "summary": "Flowise 3.0.13 and earlier may accept attacker-forged JWTs because its enterprise authentication middleware falls back to publicly known token secrets and validation values. An attacker can impersonate users, including administrators, when the JWT secret, audience, and issuer environment variables have not been explicitly configured.",
  "mitigation": "Upgrade Flowise to version 3.1.0 or later. Set unique values for JWT_AUTH_TOKEN_SECRET, JWT_REFRESH_TOKEN_SECRET, JWT_AUDIENCE, and JWT_ISSUER, and rotate existing authentication secrets.",
  "vendor": "FlowiseAI",
  "product": "Flowise",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "<=3.0.13"
      ],
      "ecosystem": "npm",
      "fixed_versions": [
        "3.1.0"
      ],
      "package_name": "flowise",
      "purl": "pkg:npm/flowise"
    }
  ],
  "cwes": [
    321
  ],
  "cvss_score": 9.8,
  "cvss_src": "nvd",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": 0.0066,
  "epss_percentile": 0.5047,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 21.255270733333333,
  "t0_at": "2026-07-12T12:06:32.246000+00:00",
  "signals": {
    "check": {
      "at": "2026-09-29T23:10:57.634043+00:00",
      "days": 79.46140495420138,
      "is_lower_bound": false,
      "measured_at": "2026-07-12T12:06:32.246000+00:00",
      "url": null
    },
    "kev": {
      "at": "2026-09-21T00:00:00+00:00",
      "days": 71,
      "is_lower_bound": false,
      "measured_at": "2026-07-12T12:06:32.246000+00:00",
      "precision": "day",
      "url": "https://vulncheck.com/cve/CVE-2026-56271"
    },
    "trigger_signal": {
      "at": "2026-09-21T00:00:00+00:00",
      "days": 70.49546011574074,
      "is_lower_bound": false,
      "measured_at": "2026-07-12T12:06:32.246000+00:00",
      "url": "https://vulncheck.com/cve/CVE-2026-56271"
    }
  }
}