Flowise through 3.1.4 allows attackers to authenticate as any existing user by assuming the user’s email address, because the system does not store bindings between the email and the SSO provider or subject identifier. As a result, an attacker who can claim any email can gain complete access to an account, including chatflows, credentials, and API keys. The vulnerability is a classic authentication bypass identified as CWE‑287 and has the potential to compromise confidentiality, integrity and availability of user data.

The flaw impacts FlowiseAI Flowise deployments running version 3.1.4 or earlier. All users who rely on email-only SSO or who registered with a local password are vulnerable if they are using a configuration that does not enforce provider or subject identifiers. No other versions or products are known to be affected.

With a CVSS score of 9.2, the vulnerability is considered critical. The EPSS score is not available, and the flaw is not listed in CISA KEV, but the lack of provider binding allows an attacker to bypass authentication remotely with only the victim’s email address. Attackers can exploit the flaw by accessing any configured SSO provider or by creating a local password login for the target email. The attack can be performed from any network location that can reach the Flowise instance, making it a high‑risk exposure for exposed services.