---
id: CVE-2026-56271
title: >-
  Flowise before 3.1.0 (affected versions 3.0.13 and earlier) uses weak
  hardcoded default JWT secrets ('auth_token', 'refresh_token') and default
  audience and issuer values ('AUDIENCE', 'ISSUER') in the enterprise passport
  authentication m…
summary: >-
  Flowise before 3.1.0 (affected versions 3.0.13 and earlier) uses weak
  hardcoded default JWT secrets ('auth_token', 'refresh_token') and default
  audience and issuer values ('AUDIENCE', 'ISSUER') in the enterprise passport
  authentication m…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-321
published: '2026-07-12'
updated: '2026-07-12'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-56271'
references:
  - url: >-
      https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-cc4f-hjpj-g9p8
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/flowise-weak-default-jwt-secrets-in-authentication-middleware
    label: disclosure@vulncheck.com
tags:
  - nvd
ingestedAt: '2026-07-12T12:20:13.381Z'
epss: 0.00655
epssPercentile: 0.4997
---

## Overview

Flowise before 3.1.0 (affected versions 3.0.13 and earlier) uses weak hardcoded default JWT secrets ('auth_token', 'refresh_token') and default audience and issuer values ('AUDIENCE', 'ISSUER') in the enterprise passport authentication middleware (packages/server/src/enterprise/middleware/passport/index.ts). When the corresponding environment variables (JWT_AUTH_TOKEN_SECRET, JWT_REFRESH_TOKEN_SECRET, JWT_AUDIENCE, JWT_ISSUER) are not set, the application silently falls back to these publicly known defaults, allowing an attacker to forge valid JWTs and impersonate any user, including administrators, resulting in authentication bypass.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.