CVE-2026-100606

Executive Summary

CVE-2026-100606 is an authentication bypass in Flowise through version 3.1.4 when deployed in Enterprise/platform mode with Single Sign-On (SSO) enabled. The flaw allows an attacker who can authenticate at any configured SSO provider using a pending invitee's email address to take over that user's invitation and gain the invited user's access to the organization — without ever possessing the emailed invitation token. No patched version was available at the time of the advisory, and no public PoC or exploit code is currently known.

Technical Analysis

Flowise is a low-code platform for building LLM orchestration flows and AI agents. In Enterprise/platform mode with SSO configured, user invitations are provisioned through the platform's organization membership system. When a user is invited, a record is created with a status of INVITED, and a single-use invitation tempToken is generated server-side and emailed to the invitee.

The vulnerability resides in the SSO login callback path. According to the NVD description, when an SSO callback arrives carrying an email claim that matches a user whose status is INVITED, the function verifyAndLogin (located in SSOBase.ts, lines 80–94) copies the user record from the database — including the server-stored single-use invitation tempToken — into the data that is subsequently passed to AccountService.register().

The register handler performs three validation checks on the invitation token:

1. A token lookup against the stored invitation token.
2. An email match between the invitation and the authenticating identity.
3. An expiration check on the invitation token.

Because the token passed into register() is the server's own stored token (copied directly from the database by verifyAndLogin), rather than a caller-supplied value, all three checks pass trivially. The attacker does not need to possess the emailed token. Following successful validation, the account and its associated organization membership are flipped from INVITED to ACTIVE.

The core defect class is CWE-287: Improper Authentication. The system conflates possession of a valid SSO identity claim with ownership of the invitation, and leaks a server-side secret (the invitation token) into a later trust decision. The invitation token ceases to be a secret possession factor and instead becomes a value the server validates against itself — a tautological check.

Attack surface: the SSO callback endpoint exposed by Flowise in Enterprise/platform mode. The vulnerability is only reachable when SSO is enabled and at least one user is in the INVITED state.

The CVSS vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L reflects a network-reachable flaw (AV:N) requiring some conditions outside the attacker's direct control (AC:H — specifically the ability to authenticate at a configured SSO provider with the invitee's email as the email claim, plus a valid pending invitation), requiring no privileges (PR:N) and no user interaction (UI:N), with high confidentiality and integrity impact and low availability impact.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class and the NVD description.

1) Reconnaissance / target identification. The attacker identifies a Flowise deployment running Enterprise/platform mode with SSO enabled. This can be inferred from login behavior, SSO redirects, or exposed platform metadata. The attacker also needs to know or guess the email address of a currently pending invitee. Corporate email address conventions, public team directories, or leaked invitation context can supply this. Invitations are valid for 24 hours by default, creating a narrow but predictable window.

2) Triggering the flaw class. The attacker authenticates at any configured SSO provider using an identity whose email claim matches the pending invitee's email address. The precise method by which the attacker obtains such an identity claim depends on the SSO provider configuration and is not specified in the advisory; it may involve a provider that permits self-registration or email-claim manipulation, or a compromised account at an upstream IdP. The key precondition is that the SSO callback arrives at Flowise with an email matching an INVITED user.

3) Execution at the vulnerability-class level. Flowise's verifyAndLogin (SSOBase.ts:80-94) retrieves the matching INVITED user record and copies it — including the server-stored tempToken — into the data passed to AccountService.register(). The register handler's three checks (token lookup, email match, expiry) all validate against the server's own copied token, so they pass trivially. No attacker-supplied invitation token is required.

4) Post-exploitation impact. The account and its organization membership flip to ACTIVE. The attacker obtains the invited user's access to the organization. Depending on the role assigned to the invitation, this may include access to flows, credentials, data, and other platform resources within that organization. The takeover is possible for the full validity window of the invitation (24 hours by default).

Impact Assessment

Successful exploitation grants the attacker the intended access of the invited user within the target organization, without possession of the emailed invitation token. The impact is bounded by the role and permissions attached to the specific pending invitation, but CVE-2026-100606 carries high confidentiality (C:H) and high integrity (I:H) subscores — reflecting the potential for data exposure and unauthorized modification within the organization — and low availability impact (A:L).

The blast radius is limited to organizations that have at least one user in the INVITED state and that run Enterprise/platform mode with SSO enabled. However, because invitations are a routine operational event, many organizations will have transient exposure windows. A single successful takeover yields the invited user's organization-scoped access; repeated exploitation across multiple pending invitations could yield multiple footholds.

The attack complexity is rated High (AC:H) because it depends on the attacker's ability to produce an SSO authentication with the invitee's email claim at a configured provider. This dependency reduces mass-exploitation potential but does not eliminate targeted risk. EPSS has not yet scored this CVE, and it is not listed in CISA KEV.

Detection Guidance

Sigma Rule

title: Flowise SSO Invitation Takeover — INVITED User Activated via SSO Callback
id: 8f2c1a44-7b9e-4c3a-9d51-flowise100606
status: experimental
description: Detects successful SSO logins by users whose account was in INVITED status, consistent with CVE-2026-100606 invitation takeover.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-100606
author: valtersit.com
date: 2026/01/01
logsource:
  product: flowise
  service: application
detection:
  selection_event:
    event|contains:
      - 'verifyAndLogin'
      - 'SSOBase'
      - 'register'
  selection_status:
    status|contains:
      - 'INVITED'
      - 'ACTIVE'
  selection_sso:
    auth_method|contains: 'sso'
  condition: selection_event and selection_status and selection_sso
falsepositives:
  - Legitimate invitees completing SSO registration with a valid emailed token
level: high
tags:
  - attack.t1078
  - cve.2026-100606

YARA Rule

rule CVE_2026_100606_Flowise_SSO_Invite_Takeover
{
    meta:
        description = "Detects Flowise SSOBase.ts invitation token handling associated with CVE-2026-100606"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-100606"
        date = "2026-01-01"
        cve = "CVE-2026-100606"

    strings:
        $ssobase = "SSOBase" ascii wide
        $verify = "verifyAndLogin" ascii wide
        $register = "AccountService.register" ascii wide
        $temp = "tempToken" ascii wide
        $invited = "INVITED" ascii wide

    condition:
        (uint32(0) == 0x0A0D0A0D or true) and
        filesize < 5MB and
        (($ssobase and $verify) or ($register and $temp) or ($verify and $temp and $invited))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-100606 Flowise SSO Invitation Takeover Attempt"; flow:to_server,established; http.uri; content:"/api/v1"; content:"sso"; nocase; http.uri; content:"callback"; nocase; http.header; content:"email"; nocase; classtype:attempted-admin; reference:cve,2026-100606; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-100606; sid:2026100606; rev:1;)

Elastic Detection

sequence by user.email with maxspan=5m
  [ authentication where event.outcome == "success" and user.status == "INVITED" ]
  [ iam where event.action in ("user_activated", "membership_activated") and
    user.status == "ACTIVE" ]

Splunk SPL Query

index=flowise sourcetype=flowise:app
| search ("verifyAndLogin" OR "SSOBase" OR "AccountService.register")
| search (status="INVITED" OR status="ACTIVE")
| stats count min(_time) as firstTime max(_time) as lastTime
        values(status) as statuses values(email) as emails
        by src_ip, user, org_id
| where count > 0
| convert ctime(firstTime) ctime(lastTime)

Wazuh OSSEC Rule

<group name="flowise,cve-2026-100606,">
  <rule id="100606" level="12">
    <decoded_as>json</decoded_as>
    <field name="service">flowise</field>
    <field name="event">verifyAndLogin|AccountService.register</field>
    <field name="status">INVITED</field>
    <description>CVE-2026-100606: Potential Flowise SSO invitation takeover — INVITED user activated</description>
    <mitre>
      <id>T1078</id>
    </mitre>
    <group>authentication_bypass,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1) Immediate mitigations.

• Disable SSO in Enterprise/platform mode where operationally feasible until a patch is available.
• If SSO must remain enabled, restrict which identity providers are configured and audit them for the ability to issue an authentication with an arbitrary or self-registered email claim. Configurations that permit self-registration or unverified email claims should be treated as high risk.
• Minimize the number of simultaneously pending invitations. Track INVITED users and expire or revoke stale invitations promptly rather than relying on the 24-hour default.
• Reduce the default invitation validity window if the platform exposes such a setting.
• Monitor for INVITED → ACTIVE transitions that are not preceded by out-of-band confirmation that the invitee completed registration with the emailed token.

2) Patch / upgrade steps.

• No vendor fix is available at the time of this advisory. There is no patched version through 3.1.4.
• Track the Flowise project for an updated release and vendor advisory. Until a fixed version is published, treat the deployment as unpatched and rely on the interim mitigations above.

3) Long-term hardening.

• Require that invitation acceptance be bound to possession of the emailed single-use token as an explicit, caller-supplied factor rather than a server-side value copied into the registration data.
• Enforce strict separation between identity-provider assertions (email claim) and invitation authorization (token possession); never treat the server's own stored secret as evidence of the caller's possession.
• Apply defense-in-depth: require re-verification of invitee identity through a channel independent of the SSO email claim before activating organization membership.
• Instrument and alert on authentication state transitions involving invitation records, and retain audit logs sufficient to reconstruct which SSO identity triggered each activation.

References

• NVD — CVE-2026-100606: https://nvd.nist.gov/vuln/detail/CVE-2026-100606
• MITRE CWE-287 — Improper Authentication: https://cwe.mitre.org/data/definitions/287.html
• MITRE ATT&CK T1078 — Valid Accounts: https://attack.mitre.org/techniques/T1078/
• Flowise project repository and release notes (vendor project page) — consult for any subsequent advisory or patched release.
• CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-100606 is not currently listed).

No known threat actor campaigns or exploit-in-the-wild evidence have been associated with CVE-2026-100606 at the time of writing. No public PoC, exploit code, or Nuclei template is known.