Flowise versions 3.0.13 and earlier use a hardcoded secret, "Secre$t", to derive the AES‑256‑CBC key for encrypting user and workspace identifiers inside the JWT token ’meta’ field. Because the JWT signature is verified separately, manipulating or decrypting this field does not immediately grant authentication, but it reveals internal identifiers that could be used for privilege escalation or unauthorized data access. The weakness is classified as CWE‑798: Use of Hard‑coded Cryptographic Key.

The affected product is Flowise (Flowise Flowise) for npm package flowise. All releases prior to 3.1.0, specifically version 3.0.13 and earlier, contain the weak default TOKEN_HASH_SECRET. No other vendors or products are listed as affected.

The CVSS score of 4.3 indicates a moderate severity. EPSS data is not available, and the vulnerability is not listed in CISA KEV, suggesting limited public exploitation. The likely attack vector involves any environment where the default secret is used; an attacker who can access the JWT token or trigger the token generation process can decrypt or tamper with the meta field due to the predictable key. Since the secret is hardcoded, the condition is present by default unless the operator explicitly sets a secure TOKEN_HASH_SECRET. Because the vulnerability does not provide direct authentication bypass, the impact requires additional exploit steps such as secondary privilege escalation or data exfiltration, but it can aid attackers in identifying valuable internal identifiers.