SSO Email-Only Authentication Bypasses User Identity Verification

Flowise through 3.1.4 resolves SSO and local-password users solely by email without storing provider or subject identifier bindings, allowing attackers to authenticate as any existing user by claiming their email at any configured SSO provider. Attackers can gain complete account access including chatflows, credentials, and API keys by authenticating through a different SSO provider or local password than the victim's original registration method.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

Flowise versions through 3.1.4 contain a critical authentication bypass vulnerability where user identity resolution relies solely on email addresses without binding to SSO provider identifiers or subject claims. This allows attackers to hijack any existing user account by authenticating through a different SSO provider (or local password) while claiming the victim's email address. The vulnerability is particularly severe because successful exploitation grants complete account access including stored chatflows, integrated credentials, and API keys—effectively providing an attacker with the same privileges and access as the compromised user. Organizations running Flowise with multiple SSO providers or mixed SSO/local authentication are especially vulnerable, as attackers can exploit the provider mismatch to assume any user identity.

Casky's 754 security skills, powered by Claude AI's extended reasoning, map directly to the account compromise techniques underlying this vulnerability. Detection focuses on MITRE ATT&CK TA0004 (Privilege Escalation) and TA0006 (Credential Access) patterns. Practitioners using Casky would identify suspicious authentication chains—such as successful logins from new SSO providers using known email addresses, authentication events showing provider switching without corresponding account configuration changes, or API key usage immediately following first-time SSO authentication for established accounts. The platform's skill coverage surfaces authentication logic flaws by analyzing identity binding weaknesses, provider-agnostic email resolution patterns, and account access immediately following cross-provider authentication attempts, enabling teams to detect exploitation before account data exfiltration occurs.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-100607.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-100607

Casky has 283 skills that investigate the attack patterns behind CVE-2026-100607. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn