Executive brief
Flowise is a platform for building AI agents and workflows with a visual interface. The application uses Express.js sessions to manage user authentication. When the EXPRESS_SESSION_SECRET environment variable is not configured, the system defaults to using the hardcoded string "flowise" as the session signing key. An attacker with knowledge of this weak secret can forge valid session cookies to impersonate any user and bypass all authentication, gaining full access to the application.
Technical details
The vulnerability exists in packages/server/src/enterprise/middleware/passport/index.ts at line 55, where the Express session secret is set to process.env.EXPRESS_SESSION_SECRET || 'flowise'. Express-session uses this secret to sign and validate session cookies. Since 'flowise' is hardcoded, publicly visible in the repository, and intentionally weak, an attacker can forge cryptographically valid session cookies for arbitrary users. The vulnerability affects all versions up to and including 3.0.13. No user interaction or network access is required beyond accessing the application (local attack vector with high privilege requirement); however, the impact is severe as an attacker can completely bypass authentication and impersonate any user. The fix is available in version 3.1.0, which requires EXPRESS_SESSION_SECRET to be explicitly set with a strong random value.
Affected products
- FlowiseAI Flowise up to 3.0.13
Timeline
- 2026-04-16: disclosed: Vulnerability published in GitHub Security Advisory GHSA-2qqc-p94c-hxwh
- 2026: patched: Fix available in version 3.1.0