Flowise: Flowise through 3.1.4 contains an authentication bypass vulnerability that allows…
Flowise
More for Flowise RSS feed for Flowise
- Severity
- High, CVSS 7.5
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- Record
- CVE-2026-70636
- Affects
- Flowise
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- August 6, 2026
- Source last modified
- October 24, 2026
Description
Flowise through 3.1.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to access the OAuth2 credential refresh endpoint by exploiting prefix-based whitelist matching in the authentication middleware defined in packages/server/src/utils/constants.ts. Attackers can send a POST request to the oauth2-credential refresh route with a trailing credential identifier to bypass all authentication and authorization checks, triggering unauthorized OAuth token rotation against credentials belonging to any workspace and potentially disrupting dependent OAuth integrations. This is a bypass of CVE-2026-41273.
Description quoted from the NVD record.
Who is affected
Flowise, a tool for building apps that use AI language models, is affected by this flaw in versions up to and including 3.1.4. The problem is in the part of the product that renews saved sign-in connections to other online services (known as OAuth credentials). An attacker who has not logged in can get past all login and permission checks and force those saved connections to be renewed, for credentials belonging to any workspace. This could disrupt the apps and integrations that rely on those connections. This flaw is rated High.
What to do
- The person who installed or runs Flowise for your organization, or the IT provider who manages it, should act on this flaw.
- Find out which version of Flowise you run. Versions up to and including
3.1.4are affected. - No fixed version is named for this flaw yet, so check the vendor advisory linked on this page for a fixed release and install it as soon as one is available.
- If an IT provider or vendor runs Flowise for you, send them this advisory and ask when the update will be done.
Analysis written from the source record as of October 24, 2026 and reviewed before publishing.