CVE-2026-70478
published 2026-08-04CVE-2026-70478: Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the POST…
PriorityP357critical9.2CVSS 4.0
AVNACLATNPRNUINVCHVILVANSCHSILSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.38%
31.2th percentile
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the POST /api/v1/oauth2-credential/refresh/:credentialId endpoint is included in WHITELIST_URLS and requires no authentication. The endpoint decrypts the stored credential, sends a refresh request to the configured OAuth provider with the client secret and refresh token, and returns the refreshed access_token in the response body. An attacker with a credential ID can use the token to access the victim's connected service and can also exhaust refresh-token quota. This issue is fixed in 3.1.3.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| flowiseai | flowise | < 3.1.2 | 3.1.2 |
| flowiseai | flowise | >= 0 < 3.1.3 | 3.1.3 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
FlowiseAI Flowise up to 3.1.2 OAuth2 improper authentication
vuldb·2026-08-04·CVSS 9.2
CVE-2026-70478 [CRITICAL] FlowiseAI Flowise up to 3.1.2 OAuth2 improper authentication
A vulnerability described as critical has been identified in FlowiseAI Flowise up to 3.1.2. This issue affects some unknown processing of the component OAuth2. The manipulation results in improper authentication.
This vulnerability is known as CVE-2026-70478. It is possible to launch the attack remotely. No exploit is available.
Upgrading the affected component is recommended.
GHSA
Flowise: Unauthenticated OAuth2 token refresh endpoint returns access tokens — enables token theft for any connected service
ghsa·2026-08-04
CVE-2026-70478 [CRITICAL] CWE-200 Flowise: Unauthenticated OAuth2 token refresh endpoint returns access tokens — enables token theft for any connected service
Flowise: Unauthenticated OAuth2 token refresh endpoint returns access tokens — enables token theft for any connected service
### Summary
The OAuth2 token refresh endpoint (`POST /api/v1/oauth2-credential/refresh/:credentialId`) is in `WHITELIST_URLS`, meaning it requires **no authentication**. It decrypts the stored credential (containing `clientId`, `clientSecret`, `refresh_token`), sends a refresh request to the configured OAuth provider, and returns the new `access_token` directly in the response body.
### Root Cause
```typescript
// packages/server/src/routes/oauth2/index.ts:393-402
res.json({
success: true,
message: 'OAuth2 token refreshed successfully',
credentialId: credential.id,
tokenInfo: {
...tokenData, // ← includes access_token!
has_new_refresh_token: !!tokenData.refresh_t
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-08-04
Published