{
 "id": "AIR-2026-1159",
 "slug": "weak-hardcoded-jwt-secrets-in-flowise-authentication",
 "title": "Weak Hardcoded JWT Secrets in Flowise Authentication",
 "summary": "Flowise uses weak hardcoded default JWT secrets and parameters in its enterprise passport authentication middleware when environment variables are unset. Attackers can forge valid JWT tokens to impersonate any user on the platform.",
 "type": "attack_on_ai",
 "categories": [
  "infra_vuln"
 ],
 "severity": 2,
 "targets": [
  "framework_or_tooling"
 ],
 "products": [
  "Flowise"
 ],
 "incident_date": "2026-07-12",
 "incident_date_precision": "day",
 "first_reported": "2026-07-12",
 "sources": [
  {
   "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56271",
   "publisher": "NVD",
   "title": "CVE-2026-56271: Flowise before 3.1.0 (affected versions 3.0.13 and earlier) uses weak hardcoded default JWT secrets ('auth_token',…",
   "published_at": "2026-07-12"
  }
 ],
 "source_count": 1,
 "confidence": 0.95,
 "status": "published",
 "origin": "seed_nvd",
 "tags": [
  "CVE-2026-56271",
  "weak-crypto",
  "jwt"
 ],
 "created_at": "2026-10-18T10:04:21.885Z",
 "updated_at": "2026-10-18T10:04:21.885Z"
}