Vulnerabilities · 75 days ago

Flowise Session Cookies Can Be Forged

Flowise is treating session cookies as the trust boundary, so a forged cookie can make the site accept an attacker as a logged-in user. That turns authentication bypass into account impersonation inside any deployment that relies on Flowise access controls. CSIRT Italia says the flaw affects Flowise versions before 3.1.0 and recommends upgrading to 3.1.0.

Timeline

• Jul 1 Reported by CSIRT Italia / ACN

Sources

1 source covering this story

• CSIRT Italia / ACN Jul 1

  Rilevata vulnerabilità in Flowise

  Rilevata una vulnerabilità con gravità "critica" in Flowise, piattaforma open-source con interfaccia drag & drop per costruire flussi personalizzati basati su modelli linguistici di grandi dimensioni (LLM).

Part of the PlainSec briefing for 2026-07-01

Editions

• Briefing for 2026-07-01

Related stories

• Apple Closes Browser-to-Kernel Paths Across Its Fleet
• Oracle Payments Bug Can Leak the Keys Behind It
• Defender Flaw Becomes Ransomware’s Privilege Shortcut