Flowise: Unauthenticated OAuth2 token refresh endpoint returns access tokens, enables token theft for any…
Flowise
More for Flowise RSS feed for Flowise
- Severity
- Critical, CVSS 10.0
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
- Record
- CVE-2026-70478
- Affects
- Flowise
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- August 4, 2026
- Source last modified
- October 24, 2026
Description
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the POST /api/v1/oauth2-credential/refresh/:credentialId endpoint is included in WHITELIST_URLS and requires no authentication. The endpoint decrypts the stored credential, sends a refresh request to the configured OAuth provider with the client secret and refresh token, and returns the refreshed access_token in the response body. An attacker with a credential ID can use the token to access the victim's connected service and can also exhaust refresh-token quota. This issue is fixed in 3.1.3.
Description quoted from the NVD record.
Who is affected
This flaw affects Flowise, a drag and drop tool for building apps that use AI language models. It affects all versions before 3.1.3. The problem is in the part of the product that renews the saved logins Flowise uses to connect to other online services. That part does not require anyone to log in. An attacker who knows the ID of one of these saved logins can get a fresh access key for it. They can use that key to get into the connected service, and they can use up the allowed number of renewals. This flaw is rated Critical.
What to do
- The person who installed or runs Flowise for your organization should check which version is in use. Any version before
3.1.3has this flaw. - If your organization runs Flowise itself, that person should update it to version
3.1.3, which fixes this flaw. Make this a priority, because no login is needed to misuse the affected part. - If an IT provider or vendor runs Flowise for your organization, send them this advisory and ask when the update to version
3.1.3will be done.
Analysis written from the source record as of October 24, 2026 and reviewed before publishing.