{"data":{"id":"ec1cd022-3fc7-41af-928a-7db77d033cae","title":"GHSA-x2g5-fvc2-gqvp: Flowise has Insufficient Password Salt Rounds","summary":"Flowise's getHash function in packages/server/src/enterprise/utils/encryption.util.ts uses a default bcrypt salt round count of 5, set through the PASSWORD_SALT_HASH_ROUNDS environment variable, which yields 2^5 = 32 iterations. The source states this is below the OWASP recommendation of 10 rounds (1024 iterations), so stored password hashes are easier to brute-force if the database is compromised. The same default is used in resetPassword (account.service.ts:568). Tracked as CWE-916 with Medium severity.","solution":"Increase default PASSWORD_SALT_HASH_ROUNDS to at least 10 (recommended by OWASP). Consider using 12 for better security-performance balance. Document that higher values increase login time but improve security.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-x2g5-fvc2-gqvp","publishedAt":"2026-03-05T21:54:31.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":"medium","severity":"medium","attackType":[],"issueType":"vulnerability","affectedPackages":["flowise@<= 3.0.12 (fixed: 3.0.13)"],"affectedPackageNames":["flowise"],"affectedPackageRefs":["npm:flowise"],"affectedVendors":[],"affectedVendorsRaw":["Flowise"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"epssCheckedAt":null,"kevDateAdded":null,"advisoryAliases":["GHSA-x2g5-fvc2-gqvp"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":null,"disclosureDate":null,"fixReleasedAt":"2026-02-03T14:06:55.481Z","daysToFix":-30,"fixCheckedAt":"2026-10-29T21:40:13.196Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.8,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"npm","name":"flowise","fixedVersion":"3.0.13","matchedVersion":"3.0.13","fixReleasedAt":"2026-02-03T14:06:55.481Z","daysToFix":-30,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:40:13.050Z"}]}}