Flowise - Authentication Bypass (CVE-2026-56270)
Description
Flowise before 3.1.0 (versions 3.0.13 and earlier) contains a missing authentication vulnerability in the /api/v1/loginmethod endpoint that allows unauthenticated users to retrieve an organization's complete SSO configuration, including OAuth client secrets in cleartext, by providing an organizationId parameter. Remote attackers can send a GET request to harvest sensitive API credentials for Google, Microsoft/Azure, GitHub, and Auth0 integrations. This affects FlowiseAI Cloud and self-hosted instances where the endpoint is exposed.
psychologyCrowdSec Analysis
CVE-2026-56270 is a high-severity authentication bypass vulnerability in Flowise versions 3.0.13 and earlier. Unauthenticated remote attackers can query the exposed /api/v1/loginmethod endpoint to retrieve an organization’s complete SSO configuration, including plaintext OAuth client secrets for Google, Microsoft/Azure, GitHub, and Auth0 integrations, potentially enabling credential theft and unauthorized access to connected services.
CrowdSec has been tracking this vulnerability and its exploits since 25th of August 2026.
CrowdSec has not observed any significant exploitation activity targeting CVE-2026-56270 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.
Attackers target the Flowise /api/v1/loginmethod endpoint with an unauthenticated organizationId query parameter to retrieve OAuth and SSO configuration data, potentially including client secrets.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2026-06-24 |
| Rule Released | 2026-08-25 |
| CrowdSec First Seen | 2026-08-28 |