EXPOSURES › CVE-2026-70478
CVE-2026-70478
CRITICALCVE-2026-70478 in Flowise allows unauthenticated access to an OAuth credential refresh endpoint, enabling attackers to steal tokens and exhaust quotas.
Prior to version 3.1.3, the POST /api/v1/oauth2-credential/refresh/:credentialId endpoint required no authentication and was incorrectly whitelisted. An attacker with a valid credential ID could decrypt stored credentials, obtain refreshed access tokens, and exhaust the refresh-token quota. DIB organizations must ensure Flowise is patched to 3.1.3 or higher and restrict access to OAuth credential management endpoints to prevent token theft and unauthorized service access.
Shame score — The vulnerability allowed unauthenticated access to a sensitive OAuth credential refresh endpoint, enabling token theft and quota exhaustion without requiring user interaction or complex exploitation.
▸ RECOMMENDED ACTION Critical severity — schedule patching of the affected products.
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the POST /api/v1/oauth2-credential/refresh/:credentialId endpoint is included in WHITELIST_URLS and requires no authentication. The endpoint decrypts the stored credential, sends a refresh request to the configured OAuth provider with the client secret and refresh token, and returns the refreshed access_token in the response body. An attacker with a credential ID can use the token to access the victim's connected service and can also exhaust refresh-token quota. This issue is fixed in 3.1.3.