Advisory · CVE-2026-100607
Flowise matches SSO users by email alone, enabling full account takeover
Flowise through 3.1.4 resolves SSO and local-password users solely by email, without storing provider or subject-identifier bindings. An attacker can authenticate as any existing user by claiming their email at any configured SSO provider, gaining complete access to chatflows, credentials, and API keys. No patched version is available.
- Vendor
- FlowiseAI
- Product
- Flowise
- Identifier / CWE
- CVE-2026-100607
CWE-287 - Action timing
- Immediate
Explain it like I’m five
The login desk files everyone under their email address and never writes down which ID office issued their badge. Anyone who shows up at a different office with your email gets handed your entire account.
- 01Email claim
The attacker authenticates at any configured SSO provider asserting a victim's email as the email claim.
- 02Email-only lookup
Flowise resolves the user solely by email, with no stored provider or subject-identifier binding.
- 03No binding check
Nothing ties the SSO identity to the existing account beyond the email string.
- 04Full takeover
The attacker is logged in as the victim, with access to chatflows, credentials, and API keys.
What happened
Flowise through 3.1.4 resolves both SSO and local-password users solely by email, without storing provider or subject-identifier bindings (CVE-2026-100607, CVSS 9.2). An attacker can authenticate as any existing user by claiming that user’s email at any configured SSO provider, gaining complete access to the victim’s chatflows, stored credentials, and API keys. No patched version is currently available.
What to do
- Consider disabling SSO login until a patched version is released.
- Restrict SSO to an identity provider where you control email verification and only trusted principals can authenticate.
- Audit account activity for sign-ins from unexpected providers or sessions the account owners do not recognize.
- Rotate credentials and API keys stored in Flowise, since a takeover exposes them.
- Apply the vendor patch as soon as it is released.
Management note
Email-only user matching is a known-bad pattern in SSO integrations, and here it yields total account takeover with no patch in hand. This is the second Flowise SSO flaw disclosed the same day with no fix; both point at the same mitigation: do not trust SSO logins from loosely controlled providers right now.