PT-2026-67813 · Flowise · Flowise

CVE-2026-70474

·

Published

2026-08-04

·

Updated

2026-08-06

CVSS v3.1

8.1

High

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.3
Description Flowise contains an issue where three OAuth2 credential endpoints look up credentials using only the id without filtering by workspaceId. Additionally, the callback and refresh handlers are whitelisted from authentication. This configuration leads to three primary security risks:
  1. Cross-workspace access: Any authenticated user can initiate OAuth2 flows against credentials in other workspaces, leaking metadata such as client id, scope, and redirect uri via the /api/v1/oauth2-credential/authorize/<VICTIM CREDENTIAL UUID> endpoint.
  2. Unauthenticated token injection: An unauthenticated attacker can overwrite tokens in any credential by forging OAuth2 callbacks via the /api/v1/oauth2-credential/callback?code=ATTACKER AUTH CODE&state=<VICTIM CREDENTIAL UUID> endpoint.
  3. Unauthenticated token theft: An unauthenticated attacker can obtain a fresh access token for any credential's connected service via the /api/v1/oauth2-credential/refresh/<VICTIM CREDENTIAL UUID> endpoint.
Recommendations Update Flowise to version 3.1.3. As a temporary mitigation, restrict access to the /api/v1/oauth2-credential/authorize/, /api/v1/oauth2-credential/callback, and /api/v1/oauth2-credential/refresh/ endpoints.

Exploit

Fix

DoS

Incorrect Authorization

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-70474
GHSA-WCH5-XP77-FXG4

Affected Products

Flowise