CVE-2026-70478
Description
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the POST /api/v1/oauth2-credential/refresh/:credentialId endpoint is included in WHITELIST_URLS and requires no authentication. The endpoint decrypts the stored credential, sends a refresh request to the configured OAuth provider with the client secret and refresh token, and returns the refreshed access_token in the response body. An attacker with a credential ID can use the token to access the victim's connected service and can also exhaust refresh-token quota. This issue is fixed in 3.1.3.
How to fix
- flowiseai flowise3.1.3 or later
- flowise3.1.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| flowiseai flowise | v < 3.1.3 | 3.1.3 |
| flowisenpm | v < 3.1.3 | 3.1.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.