Flowise prior to version 3.1.0 embeds the string 'flowise' as the default secret used by the express-session middleware when the environment variable EXPRESS_SESSION_SECRET is absent. Because this secret is baked into the source code and publicly visible, an attacker can create a signed session cookie that the application will accept as legitimate. With such a forged cookie an attacker can impersonate any authenticated user and gain full access to the application’s functionality.

The vulnerability affects Flowise installations of version 3.0.13 and earlier. The affected product is Flowise, a conversational AI development platform.

The CVSS score of 9.3 indicates a high severity. No EPSS score is available, but the flaw is publicly documented and trivial to exploit due to the publicly disclosed default secret. Attackers need only send a crafted HTTP request containing the forged cookie, so the attack vector is remote. Although the risk of exploitation is high, the vulnerability is not currently listed in CISA’s KEV catalog.