CVE-2026-70636

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.5

Description An authentication bypass exists due to prefix-based whitelist matching in the authentication middleware located in packages/server/src/utils/constants.ts. Unauthenticated attackers can send a POST request to the 'oauth2-credential refresh' endpoint with a trailing credential identifier to bypass authentication and authorization checks. This allows unauthorized OAuth token rotation for credentials in any workspace, which may disrupt dependent OAuth integrations.

Recommendations Update Flowise to version 3.1.5 or later.