https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 16:08:24 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-335974 EUVD-2026-335974 https://cve.radiocsirt.org/vuln/euvd-2026-335974 https://cve.radiocsirt.org/vuln/fkie_cve-2026-56271 <p>Flowise before 3.1.0 (affected versions 3.0.13 and earlier) uses weak hardcoded default JWT secrets (&#39;auth_token&#39;, &#39;refresh_token&#39;) and default audience and issuer values (&#39;AUDIENCE&#39;, &#39;ISSUER&#39;) in the enterprise passport authentication middleware (packages/server/src/enterprise/middleware/passport/index.ts). When the corresponding environment variables (JWT_AUTH_TOKEN_SECRET, JWT_REFRESH_TOKEN_SECRET, JWT_AUDIENCE, JWT_ISSUER) are not set, the application silently falls back to these publicly known defaults, allowing an attacker to forge valid JWTs and impersonate any user, including administrators, resulting in authentication bypass.</p> <p>Flowise before 3.1.0 (affected versions 3.0.13 and earlier) uses weak hardcoded default JWT secrets (&#39;auth_token&#39;, &#39;refresh_token&#39;) and default audience and issuer values (&#39;AUDIENCE&#39;, &#39;ISSUER&#39;) in the enterprise passport authentication middleware (packages/server/src/enterprise/middleware/passport/index.ts). When the corresponding environment variables (JWT_AUTH_TOKEN_SECRET, JWT_REFRESH_TOKEN_SECRET, JWT_AUDIENCE, JWT_ISSUER) are not set, the application silently falls back to these publicly known defaults, allowing an attacker to forge valid JWTs and impersonate any user, including administrators, resulting in authentication bypass.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-56271 https://cve.radiocsirt.org/vuln/ghsa-jpvq-qwhh-pw47 <p>Flowise before 3.1.0 (affected versions 3.0.13 and earlier) uses weak hardcoded default JWT secrets (&#39;auth_token&#39;, &#39;refresh_token&#39;) and default audience and issuer values (&#39;AUDIENCE&#39;, &#39;ISSUER&#39;) in the enterprise passport authentication middleware (packages/server/src/enterprise/middleware/passport/index.ts). When the corresponding environment variables (JWT_AUTH_TOKEN_SECRET, JWT_REFRESH_TOKEN_SECRET, JWT_AUDIENCE, JWT_ISSUER) are not set, the application silently falls back to these publicly known defaults, allowing an attacker to forge valid JWTs and impersonate any user, including administrators, resulting in authentication bypass.</p> <p>Flowise before 3.1.0 (affected versions 3.0.13 and earlier) uses weak hardcoded default JWT secrets (&#39;auth_token&#39;, &#39;refresh_token&#39;) and default audience and issuer values (&#39;AUDIENCE&#39;, &#39;ISSUER&#39;) in the enterprise passport authentication middleware (packages/server/src/enterprise/middleware/passport/index.ts). When the corresponding environment variables (JWT_AUTH_TOKEN_SECRET, JWT_REFRESH_TOKEN_SECRET, JWT_AUDIENCE, JWT_ISSUER) are not set, the application silently falls back to these publicly known defaults, allowing an attacker to forge valid JWTs and impersonate any user, including administrators, resulting in authentication bypass.</p> https://cve.radiocsirt.org/vuln/ghsa-jpvq-qwhh-pw47 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1145 <p>Ein Angreifer kann mehrere Schwachstellen in Flowise ausnutzen, um beliebigen Programmcode auszuführen, um Sicherheitsvorkehrungen zu umgehen, um Informationen offenzulegen, und um Dateien zu manipulieren.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Flowise ausnutzen, um beliebigen Programmcode auszuführen, um Sicherheitsvorkehrungen zu umgehen, um Informationen offenzulegen, und um Dateien zu manipulieren.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1145