Act nowDisclosed

Advisory · CVE-2026-100606

Flowise SSO invitation flaw lets anyone claim a pending invite

Flowise through 3.1.4 (enterprise/platform mode with SSO) has an authentication bypass in the SSO login path: when an SSO callback arrives with an email matching a user in INVITED status, the server copies the stored single-use invitation tempToken into the registration check instead of requiring the caller-supplied token. Anyone who can authenticate at a configured SSO provider with a pending invitee's email can take over the invitation and its organization access. No patched version is available.

Advisory published September 26, 2026Independent summary
Vendor
FlowiseAI
Product
Flowise
Identifier / CWE
CVE-2026-100606
CWE-287
Action timing
Immediate
ELI5

Explain it like I’m five

A party sends invitation cards with a secret code, but the bouncer checks the code against the card the party itself is holding instead of the one the guest brings. Anyone who knows a guest's name can walk in and take their seat.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01SSO callback

    The attacker authenticates at any configured SSO provider using a pending invitee's email as the email claim.

  2. 02Server token reuse

    verifyAndLogin copies the server-stored invitation tempToken into the registration data.

  3. 03Trivial checks

    Token lookup, email match, and expiry checks pass against the server's own token.

  4. 04Invite claimed

    The account and organization membership flip to ACTIVE, handing the attacker the invited user's access without the emailed token.

What happened

Flowise through 3.1.4, running in enterprise or platform mode with SSO enabled, has an authentication bypass in the SSO login path (CVE-2026-100606, CVSS 9.2). When an SSO callback arrives with an email matching a user in INVITED status, the server copies the stored single-use invitation tempToken into the registration check instead of requiring the caller-supplied token. All subsequent checks (token lookup, email match, expiry) then trivially pass against the server’s own data. Anyone who can authenticate at any configured SSO provider with a pending invitee’s email can therefore take over the invitation and its organization access without ever seeing the emailed invite token. No patched version is currently available.

What to do

  1. Consider disabling SSO login until a patched version is released, or restrict it to a tightly controlled IdP where email claims are trustworthy.
  2. Audit the pending-invitation list and revoke invitations that are not needed.
  3. Review organization memberships for accounts that flipped from INVITED to ACTIVE via SSO without the invitee’s knowledge.
  4. Monitor SSO sign-ins for email claims that do not match the authenticated subject’s verified email.
  5. Apply the vendor patch as soon as it is released.

Management note

With no patch available, the mitigation is configuration: shrink the invitation pool and make sure your IdP only lets the right people claim the right emails. AI platforms like Flowise hold credentials and API keys, so an invitation takeover here can cascade into infrastructure access.