CVE-2026-56278 CRITICAL

CVE-2026-56278: Flowise - Session Hijacking via Weak Default Express Session Secret

Vendor Flowise
Product Flowise
Weakness CWE-798 · Hardcoded credentials
Published June 30, 2026
Last update July 1, 2026
View on NVD All CVEs

CVSS base score

9.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Flowise before 3.1.0 (affected versions 3.0.13 and earlier) uses a weak hardcoded default secret ('flowise') for the express-session middleware when the EXPRESS_SESSION_SECRET environment variable is not set (packages/server/src/enterprise/middleware/passport/index.ts). Because this default secret is publicly visible in the source code, an attacker can forge valid signed session cookies to impersonate any user and bypass authentication.

Key dates

02Disclosure timeline

June 30, 2026 CVE published
July 1, 2026 Record updated