FlowiseAI Flowise through version 3.1.4 has an authentication design flaw where user identity is resolved only by email address, ignoring the SSO provider or subject identifier bindings. This allows an attacker to impersonate any existing user by authenticating through a different SSO provider or local password than the victim's original registration method. As a result, attackers can gain complete access to the victim's account and sensitive data such as chatflows, credentials, and API keys. The vulnerability has a CVSS 4.0 score of 9.2, indicating critical severity.

An attacker can fully compromise any user account by exploiting this vulnerability, gaining unauthorized access to sensitive application data and credentials. This can lead to data theft, unauthorized actions, and potential further compromise of integrated systems through exposed API keys.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to trusted users and monitor for suspicious authentication attempts. Avoid using multiple SSO providers with the same email addresses if possible.