The flaw resides in Flowise's enterprise passport authentication middleware, where the application defaults to hard‑coded JWT secrets and predictable audience and issuer strings when environment variables are absent. This weakness corresponds to CWE-321 (Weak Cryptographic Keys), and because the secrets "auth_token" and "refresh_token" are globally known, an attacker can generate valid JSON Web Tokens and impersonate any user, including administrators. This results in an authentication bypass that compromises confidentiality, integrity and availability of the system.

The vulnerability affects Flowise versions 3.0.13 and earlier, distributed under the Flowise:Flowise vendor. Any installation of these affected versions that has not overridden the default JWT settings is susceptible. The issue is limited to the enterprise passport authentication component but allows full impersonation once exploited.

With a CVSS score of 9.3 the vulnerability is considered critical. The EPSS score is < 1%, indicating a low overall chance of exploitation, and it is not listed in CISA KEV. However, if the application runs with the default JWT secrets, no custom JWT secret, audience or issuer values, an attacker can forge valid tokens with no additional effort; in such environments verification is trivial and an attacker can immediately impersonate any user.