GHSA-R745-8HWV-H473 Flowise: Unauthenticated OAuth2 Refresh Enables Non-Blind SSRF and Secret Exfiltration

Summary The OAuth2 token refresh endpoint POST /api/v1/oauth2-credential/refresh/:credentialId is unauthenticated by design it is in the public whitelist and performs a server-side HTTP request to a credential-controlled URL accessTokenUrl without SSRF protections. In runtime validation, this...

CVE-2025-57247

The BATBToken contract (address 0xfbf1388408670c02f0dbbb74251d8ded1d63b7a2; compiler v0.8.26+commit.8a97fa7a) has an access-control flaw in whitelist management: setColdWhiteList() and setSpecialAddress() are declared public without proper restrictions. This enables any user to bypass cold-time t...