# CVE-2026-56270: Flowise - Authentication Bypass

> Live exploitation tracking for CVE-2026-56270 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2026-56270

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 8.7
- **Public exploit available:** Yes
- **Affected products:** Flowise
- **Weaknesses:** CWE-306 (Missing Authentication for Critical Function)
- **Tags:** ai_mcp, web_application, javascript

## Description

Flowise before 3.1.0 (versions 3.0.13 and earlier) contains a missing authentication vulnerability in the /api/v1/loginmethod endpoint that allows unauthenticated users to retrieve an organization's complete SSO configuration, including OAuth client secrets in cleartext, by providing an organizationId parameter. Remote attackers can send a GET request to harvest sensitive API credentials for Google, Microsoft/Azure, GitHub, and Auth0 integrations. This affects FlowiseAI Cloud and self-hosted instances where the endpoint is exposed.

## CrowdSec analysis

[CVE-2026-56270](https://euvd.enisa.europa.eu/vulnerability/CVE-2026-56270) is a high-severity authentication bypass vulnerability in Flowise versions 3.0.13 and earlier. Unauthenticated remote attackers can query the exposed `/api/v1/loginmethod` endpoint to retrieve an organization’s complete SSO configuration, including plaintext OAuth client secrets for Google, Microsoft/Azure, GitHub, and Auth0 integrations, potentially enabling credential theft and unauthorized access to connected services.

CrowdSec has been tracking this vulnerability and its exploits since 25th of August 2026.

CrowdSec has not observed any significant exploitation activity targeting CVE-2026-56270 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers target the Flowise `/api/v1/loginmethod` endpoint with an unauthenticated `organizationId` query parameter to retrieve OAuth and SSO configuration data, potentially including client secrets.

## Timeline

- 2026-06-24: CVE Published. CVE-2026-56270 is published to NVD.
- 2026-08-25: Rule Released. CrowdSec releases a rule to detect CVE-2026-56270 exploitation attempts against the CrowdSec Network.
- 2026-08-28: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2026-56270 for the first time.

## References

- https://www.vulncheck.com/advisories/flowise-unauthenticated-oauth-secrets-disclosure-via-api-v1-loginmethod-endpoint
- https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-6pcv-j4jx-m4vx
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-56270.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2026-56270) follows observed exploitation activity for CVE-2026-56270. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.