Flowise Basic Authentication Vulnerability Allowing Credential Exposure and Brute-Force Attacks

A vulnerability in Flowise's checkBasicAuth endpoint prior to version 3.1.2 allows for plaintext credential validation without rate limiting, using direct comparison. This lack of rate limiting enables brute-force attacks on the authentication system. The endpoint returns distinct messages for successful and failed authentication attempts, facilitating credential enumeration. The vulnerability has been patched in version 3.1.2.

Impact

The vulnerability allows attackers to perform unlimited brute-force attempts on usernames and passwords, potentially gaining unauthorized access to the application.

Remediation

Users can update to Flowise version 3.1.2 to address this vulnerability.