Skip to content
AI Sec Watch
MediumVulnerability

GHSA-x2g5-fvc2-gqvp: Flowise has Insufficient Password Salt Rounds

Source
GitHub Advisory(opens in a new tab)
Identifier
GHSA-x2g5-fvc2-gqvp
Published
Record updated
View JSON
Affected
  • flowise <= 3.0.12
Fixed in
3.0.13
  • released February 3, 2026, 30 days before disclosure

Summary

Flowise's getHash function in packages/server/src/enterprise/utils/encryption.util.ts uses a default bcrypt salt round count of 5, set through the PASSWORD_SALT_HASH_ROUNDS environment variable, which yields 2^5 = 32 iterations. The source states this is below the OWASP recommendation of 10 rounds (1024 iterations), so stored password hashes are easier to brute-force if the database is compromised. The same default is used in resetPassword (account.service.ts:568). Tracked as CWE-916 with Medium severity.

Mitigation

Increase default PASSWORD_SALT_HASH_ROUNDS to at least 10 (recommended by OWASP). Consider using 12 for better security-performance balance. Document that higher values increase login time but improve security.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.