Flowise Hardcoded JWT Secrets Enable Authentication Bypass

Flowise versions 3.0.13 and earlier contain a critical authentication vulnerability in their enterprise passport middleware that uses hardcoded default JWT secrets and configuration values. When administrators fail to set required environment variables (JWT_AUTH_TOKEN_SECRET, JWT_REFRESH_TOKEN_SECRET, JWT_AUDIENCE, JWT_ISSUER), the application silently falls back to weak, publicly known defaults like 'auth_token' and 'refresh_token'. This vulnerability affects any organization deploying Flowise in enterprise environments without explicit configuration, allowing attackers to forge valid JWT tokens and gain unauthorized access to the platform with a CVSS score of 9.8. The silent fallback mechanism is particularly dangerous because administrators may believe their deployment is secure when it actually uses predictable cryptographic material.

While this CVE doesn't map to specific MITRE ATT&CK techniques, Casky's security skills would detect the underlying attack patterns through analysis of authentication traffic and token validation failures. Practitioners using Casky would identify suspicious JWT token generation attempts, detect repeated successful authentications with hardcoded credentials, and spot patterns consistent with CWE-321 (Use of Hard-Coded Cryptographic Key) violations. Casky's extended reasoning capabilities would flag environment variable configurations missing JWT secret definitions, correlate authentication logs showing tokens signed with weak keys, and highlight the dangerous pattern of unauthenticated fallbacks in security-critical middleware—enabling teams to remediate before exploitation occurs.