Beveiligingsadvies

CVE-2026-56270

CVE-kwetsbaarheidsdetails - eXtreme Datacenter Security Operations

Gepubliceerd 2026-06-24 11:53:14

Laatst bijgewerkt 2026-06-24 12:46:16

Toegewezen door VulnCheck

CVSS-score 8.7

Status PUBLISHED

Beschrijving

Flowise before 3.1.0 (versions 3.0.13 and earlier) contains a missing authentication vulnerability in the /api/v1/loginmethod endpoint that allows unauthenticated users to retrieve an organization's complete SSO configuration, including OAuth client secrets in cleartext, by providing an organizationId parameter. Remote attackers can send a GET request to harvest sensitive API credentials for Google, Microsoft/Azure, GitHub, and Auth0 integrations. This affects FlowiseAI Cloud and self-hosted instances where the endpoint is exposed.

← Alle CVE's bekijken Bekijk op cve.org ↗