CVE-2026-100606 is an authentication bypass vulnerability in FlowiseAI Flowise (up to version 3.1.4) when operating in Enterprise/platform mode with SSO enabled. The issue occurs in the SSO login callback handling where, if the email claim matches a user with INVITED status, the server copies the user record including the server-stored single-use invitation token into the registration data. The register handler then validates the token against this server-side token rather than a caller-supplied token, causing the checks to pass trivially. Consequently, an attacker who can authenticate via any configured SSO provider with the invited user's email can activate the account and gain organization membership without possessing the emailed invitation token. The invitation validity period is 24 hours by default. No official fix or patch is available at the time of publication.

An attacker who can authenticate through any configured SSO provider using the email address of a user with a pending invitation can bypass the invitation token requirement and activate the invited account. This grants unauthorized access to the organization with the invited user's privileges for the duration of the invitation validity (default 24 hours). This compromises the integrity of the invitation process and allows privilege escalation without possession of the invitation token.

At the time of this advisory, no patch or official fix is available. Users should monitor the vendor's advisory for updates. Until a fix is released, organizations should consider disabling SSO login for invited users or restricting SSO providers to trusted identities to reduce exposure. Avoid relying solely on the invitation token mechanism for authentication in SSO-enabled environments.