Is CVE-2026-100607 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-100607 being exploited in the wild.

How severe is CVE-2026-100607?

High severity, with a CVSS score of 7.7, published 26 September 2026.

Which products and versions are affected?

FlowiseAI Flowise through 3.1.4.

Is there a fix for CVE-2026-100607?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-100607 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-100607?

Check whether you run FlowiseAI Flowise at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-100607: Flowise authentication bypass via email-only SSO matching

CVE-2026-100607 · Severity: high · CVSS 7.7 · Published 2026-09-26

Flowise, a low-code platform for building conversational AI applications, resolves user accounts based solely on email address across multiple SSO providers without storing provider identity bindings. An attacker can take over any user account by authenticating through a different SSO provider or local password with that user's email address, gaining access to all chatflows, stored credentials, and API keys.

Technologies: FlowiseAI Flowise. Vendors: FlowiseAI.

Quick answers

Is CVE-2026-100607 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-100607 being exploited in the wild.
How severe is CVE-2026-100607?: High severity, with a CVSS score of 7.7, published 26 September 2026.
Which products and versions are affected?: FlowiseAI Flowise through 3.1.4.
Is there a fix for CVE-2026-100607?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-100607 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-100607?: Check whether you run FlowiseAI Flowise at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in SSOBase.verifyAndLogin() which resolves users by email alone (userService.readUserByEmail()) without checking the provider-issued subject identifier (sub) or maintaining (provider, sub) bindings. When a verified email claim arrives from any SSO provider (Google, Auth0, Azure AD, GitHub) or local password, the system grants session access to the matching email account regardless of how it was originally registered. The fix requires storing (provider, sub) bindings and rejecting unrecognized provider-subject pairs rather than auto-merging accounts by email.

Affected products

FlowiseAI Flowise through 3.1.4

Timeline

2026-09-26: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.