Executive brief
Flowise, an open-source tool for building LLM applications, uses a weak default secret key for managing user sessions if one is not explicitly provided by the administrator. Because this default key is publicly known, an attacker could potentially forge session cookies to impersonate other users. This could lead to unauthorized access to the application and its data if the system is not properly configured with a unique secret.
Technical details
Flowise versions up to 3.0.13 contain a hard-coded default value for the Express session secret in 'packages/server/src/enterprise/middleware/passport/index.ts'. If the 'EXPRESS_SESSION_SECRET' environment variable is not set, the application defaults to using the string 'flowise'. Because this secret is used to sign session cookies and is publicly visible in the source code, an attacker can forge valid session cookies to impersonate any user. This bypasses authentication mechanisms. The vulnerability is mitigated in version 3.1.0, which likely requires a strong secret to be set at startup.
Affected products
- FlowiseAI flowise <= 3.0.13
Timeline
- 2026-04-15: disclosed
- 2026-04-16: advisory: GitHub Advisory GHSA-2qqc-p94c-hxwh published
- 2026-04-16: patched: Fixed in version 3.1.0
References
- https://api.github.com/users/kolega-ai-dev
- https://github.com/kolega-ai-dev
- https://api.github.com/users/kolega-ai-dev/gists%7B/gist_id%7D
- https://api.github.com/users/kolega-ai-dev/repos
- https://avatars.githubusercontent.com/u/250560052?v=4
- https://api.github.com/users/kolega-ai-dev/events%7B/privacy%7D