Flowise CVE-2026-70636: Missing Auth on OAuth2 Credential Refresh Endpoint

Vulnerability Overview CVE-2026-70636 - Flowise Missing Authorization on OAuth2 Credential Refresh Endpoint Product: Flowise Component: OAuth2 Credential Refresh API Vulnerability Type: Missing authorization leading to cross-workspace OAuth credential refresh CVE: CVE-2026-70636 CWE: CWE-862, CWE-639 Severity: High Affected Versions: Flowise 3.1.3 Researchers: CayCon, piropatriot Executive Summary: The OAuth2 credential refresh functionality in Flowise contains an authorization bypass vulnerability. Although earlier advisories (GHSA-6f7g-v4pp-r667) addressed unauthorized access to the OAuth refresh endpoint, the implementation in Flowise 3.1.3 remains effective as unauthorized. The refresh endpoint is still present in the application's global whitelist, allowing requests to bypass normal API key and JWT authentication middleware. Once invoked, the endpoint retrieves OAuth credentials solely via the credential identifier, decrypts the stored client credentials, performs the OAuth refresh request, and updates the credential record without verifying workspace ownership or user authorization. Consequently, attackers possessing a valid credential identifier can trigger OAuth token refresh operations for credentials belonging to other workspaces. Scope Affected Versions: Flowise 3.1.3 Affected Components: - - - Affected Files: - - - Remediation 1. Remove from Whitelist: Remove the endpoint from the global whitelist. 2. Add Authentication: Implement necessary authentication and authorization checks on the refresh endpoint to ensure only authorized users can perform refresh operations. 3. Verify Workspace Ownership: Validate that the caller belongs to the workspace associated with the credential before refreshing it. Technical Details Flowise exposes an endpoint responsible for refreshing stored OAuth credentials: Under normal circumstances, requests reaching sensitive API endpoints should first pass through the application's authentication middleware, which validates API keys or authenticated user sessions. However, Flowise maintains a route whitelist that excludes these endpoints from the authorization process. The whitelist includes: During request processing, the server evaluates whitelist entries using the following code: Since the comparison uses prefix matching rather than exact routing, the following request is also considered whitelisted: As a result, requests completely bypass the application's normal authentication and authorization middleware. Upon entering the refresh handler, the implementation retrieves OAuth credentials using only the provided credential identifier. The handler performs the following actions: Loads the credential record Decrypts stored OAuth keys Executes the OAuth refresh request Stores the returned access token Updates the credential in persistent storage At no point does the handler verify: The caller's identity Workspace membership Credential ownership RBAC permissions Therefore, the authorization decision relies entirely on knowledge of the credential identifier. Attack Scenario Assumptions: Workspace A owns an OAuth credential The attacker has obtained the credential identifier The attacker does not have an authenticated Flowise session The attacker submits: Because the request matches the whitelisted route, it bypasses authentication. The handler retrieves the credential, decrypts its stored client credential and refresh token, sends a refresh request to the OAuth provider, and updates the credential without any authorization check. Laboratory Reproduction Test Environment: Flowise 3.1.3 Clean installation Source commit: Steps: 1. Configure OAuth2 credential 2. Record its credential identifier 3. Submit the following without authentication: Observed Behavior: Request accepted Authentication middleware bypassed Credential loaded OAuth refresh request executed Credential updated Source Code Verification Confirmation: Control Verification: Impact An attacker who obtains a credential identifier can trigger OAuth refresh operations for credentials belonging to other workspaces. Potential consequences include: Unauthorized OAuth token rotation Manipulation of credential lifecycles Cross-workspace OAuth credential modification Disruption of OAuth integrations Bypass of expected workspace isolation Although the refreshed access token is not directly returned to the attacker, the unauthorized mutation of credential state represents a severe integrity violation.

Goal Reached Thanks to every supporter — we hit 100%!

Flowise CVE-2026-70636: Missing Auth on OAuth2 Credential Refresh Endpoint

More from this source