CVE-2026-100607 Flowise through 3.1.4 Authentication Bypass via Email-Only SSO
Attackers can bypass authentication and take over any user account by exploiting email-only SSO resolution in Flowise.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-100607?
CVE-2026-100607 is a critical authentication bypass vulnerability in FlowiseAI Flowise, published on 26 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Flowise through 3.1.4 resolves SSO and local-password users solely by email without storing provider or subject identifier bindings, allowing attackers to authenticate as any existing user by claiming their email at any configured SSO provider. Attackers can gain complete account access including chatflows, credentials, and API keys by authenticating through a different SSO provider or local password than the victim's original registration method.
Weakness: CWE-287
Which versions are affected by CVE-2026-100607?
How do I fix CVE-2026-100607?
No fix has been published for CVE-2026-100607 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-100607 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-100607 exists.
Sources
Also known as GHSA-cffm-583c-vffr, GHSA-mjgh-prrr-9qw5.