Vulnerabilities & Exploits · Web App Attack

Flowise session cookies can be forged

Flowise is treating session cookies as the trust boundary, so a forged cookie can make the site accept an attacker as a logged-in user. That turns authentication bypass into account impersonation inside any deployment that relies on Flowise access controls. CSIRT Italia says the flaw affects Flowise versions before 3.1.0 and recommends upgrading to 3.1.0.

1 source · Jul 1

Timeline

• Jul 1 Reported by CSIRT Italia / ACN

Sources

• Jul 1 CSIRT Italia / ACN

  Rilevata vulnerabilità in Flowise

  Rilevata una vulnerabilità con gravità "critica" in Flowise, piattaforma open-source con interfaccia drag & drop per costruire flussi personalizzati basati su modelli linguistici di grandi dimensioni (LLM).

  original

Part of the PlainSec briefing for 2026-07-01

Every edition of this story: Flowise session cookies can be forged

More from today

• Apple closes browser-to-kernel paths across its fleet
• Oracle Payments bug can leak the keys behind it
• Defender flaw becomes ransomware’s privilege shortcut