GHSA-php6-83fg-gw3g: FlowiseAI Exposes Basic Auth Credentials via API

Summary

A Kolega.dev Deep Code Scan flagged the checkBasicAuth endpoint in FlowiseAI at packages/server/src/enterprise/controllers/account.controller.ts:128-135 as Medium severity under CWE-522 (Insufficiently Protected Credentials). The endpoint compares plaintext username and password from the request body directly against the FLOWISE_USERNAME and FLOWISE_PASSWORD environment variables, with no rate limiting and different responses for success and failure. Attackers can therefore attempt unlimited credential brute-forcing and enumerate valid credentials.

Mitigation

1) Implement rate limiting on this endpoint, 2) Use constant-time comparison to prevent timing attacks, 3) Consider using hashed comparison, 4) Return generic error messages, 5) Add logging for failed attempts.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• flowisenpmLLM dependency since 2024-03-12

Related items

• MediumCVE-2026-102610: fast-agent serve unauthenticated remote command execution via /mcp endpointSimilar attack · NVD/CVE Database
• CriticalCVE-2026-58490: Tracecat SAML authentication bypass through unsigned responses in Docker ComposeSimilar attack · NVD/CVE Database
• MediumCVE-2026-124028: mistral.rs delimiter injection allows attacker-chosen tool calls via quoted textSimilar attack · NVD/CVE Database
• HighCVE-2026-123974: TorchServe local privilege escalation via predictable /tmp extraction directorySimilar attack · NVD/CVE Database
• InfoOpenAI Says New GPT-6 Cyber Model Hunts Flaws Without Crossing the LineSimilar attack · SecurityWeek