CVE-2026-70636: Missing Authorization

Flowise through 3.1.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to access the OAuth2 credential refresh endpoint by exploiting prefix-based whitelist matching in the authentication middleware defined in packages/server/src/utils/constants.ts. Attackers...

PT-2026-68792

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.5 Description An authentication bypass exists due to prefix-based whitelist matching in the authentication middleware located in packages/server/src/utils/constants.ts. Unauthenticated attackers can send a POST...

CVE-2026-70478

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the POST /api/v1/oauth2-credential/refresh/:credentialId endpoint is included in WHITELISTURLS and requires no authentication. The endpoint decrypts the stored credential, sends a refresh...

CVE-2026-70478: Exposure of Sensitive Information to an Unauthorized Actor

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the POST /api/v1/oauth2-credential/refresh/:credentialId endpoint is included in WHITELISTURLS and requires no authentication. The endpoint decrypts the stored credential, sends a refresh...

CVE-2026-69250: Authorization Bypass Through User-Controlled Key

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the OAuth2 token refresh endpoint POST /api/v1/oauth2-credential/refresh/:credentialId is unauthenticated by design and performs a server-side HTTP request to the credential-controlled...

PT-2026-67930

Summary The OAuth2 token refresh endpoint POST /api/v1/oauth2-credential/refresh/:credentialId is in WHITELIST URLS, meaning it requires no authentication. It decrypts the stored credential containing clientId, clientSecret, refresh token, sends a refresh request to the configured OAuth provider,...

PT-2026-67728

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.3 Description An unauthenticated endpoint POST /api/v1/oauth2-credential/refresh/:credentialId allows for Server-Side Request Forgery SSRF, a condition where the server is tricked into making requests to an...