CVE-2026-70478

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.3

Description The POST /api/v1/oauth2-credential/refresh/:credentialId endpoint is included in WHITELIST URLS, which allows it to be accessed without authentication. When this endpoint is called, the server decrypts the stored credential containing the clientId, clientSecret, and refresh token, and sends a refresh request to the configured OAuth provider. The server then returns the new access token directly in the response body. An attacker who obtains a credential ID can use this mechanism to steal access tokens and gain full access to a victim's connected third-party services, such as Google, Microsoft, or GitHub. Additionally, this can be used to cause a denial of service by exhausting the refresh token quota.

Recommendations Update to version 3.1.3. Remove the POST /api/v1/oauth2-credential/refresh/:credentialId endpoint from WHITELIST URLS and implement an authentication check in the route handler.