Authentication Bypass in Flowise Affects User Data Security
CVE-2026-41273

7.7HIGH

Key Information:

Vendor

Flowiseai

Status
Flowise
Vendor
CVE Published:
23 April 2026

What is CVE-2026-41273?

Flowise, a drag-and-drop interface for customizing large language model workflows, has a vulnerability that allows unauthorized access to OAuth 2.0 access tokens. Prior to version 3.1.0, an unauthenticated attacker could exploit this authentication bypass by accessing a public chatflow configuration endpoint. This access could lead to the retrieval of sensitive internal workflow data, including OAuth credential identifiers. Attackers could then refresh and acquire valid OAuth access tokens without the need for authentication, posing a significant risk to user data security. The issue has been addressed in version 3.1.0.

Affected Version(s)

Flowise < 3.1.0

References

https://github.com/FlowiseAI/Flowise/security/advisories/...
x_refsource_CONFIRM

CVSS V4

Score:
7.7
Severity:
HIGH
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.