{"data":{"id":"ec1cd022-3fc7-41af-928a-7db77d033cae","title":"GHSA-x2g5-fvc2-gqvp: Flowise has Insufficient Password Salt Rounds","summary":"Flowise uses an insufficiently weak password hashing setting where bcrypt (a password encryption algorithm) is configured with only 5 salt rounds, which provides just 32 iterations compared to OWASP's recommended minimum of 10 rounds (1024 iterations). This weakness means that if a database is stolen, attackers can crack user passwords roughly 30 times faster using modern GPUs, putting all user accounts at risk.","solution":"The source recommends increasing the default PASSWORD_SALT_HASH_ROUNDS environment variable to at least 10 (as recommended by OWASP), or considering 12 for a better balance between security and login performance. The source also recommends documenting that higher values will increase login time but improve security. Note: the source acknowledges that existing password hashes created with 5 rounds will remain vulnerable even after this change is applied.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-x2g5-fvc2-gqvp","publishedAt":"2026-03-05T21:54:31.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":"medium","severity":"medium","attackType":["other"],"issueType":"vulnerability","affectedPackages":["flowise@<= 3.0.12 (fixed: 3.0.13)"],"affectedVendors":["LangChain"],"affectedVendorsRaw":["Flowise"],"classifierModel":"claude-haiku-4-5-20251001","classifierPromptVersion":"v3","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"patchAvailable":null,"disclosureDate":null,"capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality"],"aiComponentTargeted":"api","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null}}