CVE-2026-69250: Authorization Bypass Through User-Controlled Key

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the OAuth2 token refresh endpoint POST /api/v1/oauth2-credential/refresh/:credentialId is unauthenticated by design and performs a server-side HTTP request to the credential-controlled...

PT-2026-67728

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.3 Description An unauthenticated endpoint POST /api/v1/oauth2-credential/refresh/:credentialId allows for Server-Side Request Forgery SSRF, a condition where the server is tricked into making requests to an...