Flowise Authentication Vulnerability Allows Account Takeover via Email Matching

# Flowise Authentication Vulnerability Allows Account Takeover via Email Matching

https://gcdradar.vercel.app/incidents/flowise-authentication-vulnerability-allows-account-takeover · AIR-2026-0210 · closed 2026-09-26

- Lane: Patch now
- Severity: 2 (Disclosed vulnerability)
- Fix status: No patch yet
- First reported: 2026-09-26
- AI role: Attack on AI
- Products: Flowise
- CVE ids: CVE-2026-100607
- CVSS: 9.2

## Summary

Flowise versions up to 3.1.4 resolve SSO users solely by email without proper provider bindings. Attackers can gain complete account access by authenticating with the victim's email through a different provider.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Affected and fixed versions

- Affected: flowise <= 3.1.4

## Latest updates

- 2026-09-26: GitHub advisory published (https://github.com/advisories/GHSA-mgrx-3hqw-485h)
- 2026-09-26: CVE-2026-100607: Flowise through 3.1.4 resolves SSO and local-password users solely by email without storing provider or subject identifier… (https://nvd.nist.gov/vuln/detail/CVE-2026-100607)

## Sources

- 2026-09-26 NVD: CVE-2026-100607: Flowise through 3.1.4 resolves SSO and local-password users solely by email without storing provider or subject identifier… https://nvd.nist.gov/vuln/detail/CVE-2026-100607
- 2026-09-26 GitHub Advisory Database: GHSA-mgrx-3hqw-485h: Duplicate Advisory: INVITED users auto-promoted via SSO email match (invite-token bypass) https://github.com/advisories/GHSA-mgrx-3hqw-485h

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.