Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| flowise | npm | <= 3.1.1 | 3.1.2 |
Miggo AIRoot Cause AnalysisThe vulnerability lies in the checkBasicAuth function within the AccountController. This function directly compares plaintext username and password from the request body against environment variables. The absence of rate limiting on this endpoint makes it highly susceptible to brute-force attacks. Furthermore, the function returns distinct messages for successful and failed authentication attempts, which allows an attacker to enumerate valid credentials. The patch addresses this vulnerability by completely removing the basic authentication feature, including the checkBasicAuth and getBasicAuth functions and their corresponding routes. The getBasicAuth function, while not directly involved in the authentication check, contributed to the vulnerability by disclosing whether basic authentication was enabled, thus aiding an attacker.
AccountController.checkBasicAuthpackages/server/src/enterprise/controllers/account.controller.ts
AccountController.getBasicAuthpackages/server/src/enterprise/controllers/account.controller.ts