OAuth2 Endpoint Vulnerability in Flowise Product by FlowiseAI
CVE-2026-70474

7.6HIGH

Key Information:

Vendor

Flowiseai

Status
Flowise
Vendor
CVE Published:
4 August 2026

What is CVE-2026-70474?

A security flaw in Flowise prior to version 3.1.3 allows authenticated users to initiate unauthorized OAuth2 flows against credentials from other workspaces. Specifically, the authorize, callback, and refresh handlers query the Credential table using only the credential ID, neglecting the workspace ID filter. This oversight enables an unauthenticated attacker to forge OAuth2 callbacks to overwrite tokens associated with any credential. Furthermore, it permits the refreshing of tokens for any credential, drastically compromising credential security. The affected routes include /api/v1/oauth2-credential/authorize/<VICTIM_CREDENTIAL_UUID>, /api/v1/oauth2-credential/callback?code=ATTACKER_AUTH_CODE&state=<VICTIM_CREDENTIAL_UUID>, and /api/v1/oauth2-credential/refresh/<VICTIM_CREDENTIAL_UUID>. The issue has been resolved in version 3.1.3.

Affected Version(s)

Flowise < 3.1.3

References

https://github.com/FlowiseAI/Flowise/security/advisories/...
x_refsource_CONFIRM
https://github.com/FlowiseAI/Flowise/releases/tag/flowise...
x_refsource_MISC

CVSS V4

Score:
7.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.