CVE-2026-41273

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.0

Description An authentication bypass allows an unauthenticated attacker to obtain OAuth 2.0 access tokens associated with a public chatflow. By accessing the endpoint 'GET /api/v1/public-chatbotConfig/', an attacker can retrieve internal flowData containing OAuth credential identifiers in the credential field. These identifiers can then be used via the endpoint 'POST /api/v1/oauth2-credential/refresh/', which allows OAuth 2.0 tokens to be refreshed without authentication or authorization checks. This combination enables the disclosure of valid access tokens for third-party services, potentially leading to unauthorized data access or account compromise.

Recommendations Update to version 3.1.0.