Threats tagged 'ghsa-jpvq-qwhh-pw47'

Flowise versions 3.0.13 and earlier use weak hardcoded default JWT secrets and default audience and issuer values in their enterprise passport authentication middleware. If the environment variables for these JWT parameters are not set, the application falls back to publicly known default values, enabling attackers to forge valid JWTs and impersonate any user, including administrators, leading to authentication bypass.