Vulnerability · Published Jun 30, 2026 · Assigned by VulnCheck

CVE-2026-56278Flowise - Session Hijacking via Weak Default Express Session Secret

Critical 9.1

In plain English

A critical-severity hard-coded credentials in Flowise from Flowise. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.1Critical

Exploit odds (30 days)0.5%top 55.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Flowise before 3.1.0 (affected versions 3.0.13 and earlier) uses a weak hardcoded default secret ('flowise') for the express-session middleware when the EXPRESS_SESSION_SECRET environment variable is not set (packages/server/src/enterprise/middleware/passport/index.ts). Because this default secret is publicly visible in the source code, an attacker can forge valid signed session cookies to impersonate any user and bypass authentication.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	flowise	3.1.0	GHSA-2qqc-p94c-hxwh

Affected products (as reported)

Vendor	Product	Versions
Flowise	Flowise	0 – before 3.1.0

Weakness: CWE-798 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References

GitHub Security Advisory (GHSA-2qqc-p94c-hxwh) vendor-advisory
VulnCheck Advisory: Flowise - Session Hijacking via Weak Default Express Session Secret third-party-advisory