Unauthenticated OAuth2 token refresh endpoint in Flowise (CVE-2026-70478)

The OAuth2 token refresh endpoint (`POST /api/v1/oauth2-credential/refresh/:credentialId`) in Flowise is included in `WHITELIST_URLS`, requiring no authentication. An attacker who obtains a credential ID can call this endpoint to trigger a token refresh and receive the resulting `access_token` directly in the response body, gaining full access to the victim's connected third-party accounts (Google, Microsoft, GitHub, etc.). The endpoint can additionally be abused to exhaust a victim's OAuth2 refresh token quota, causing a denial-of-service condition. Affected versions: - <= 3.1.2 We recommend updating to: 3.1.3. CVSS 9.2 · our assessment: act_now Reference: https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-qgvm-j2hm-6m38 Details: https://vuln.today/cve/CVE-2026-70478