Flowise CVE-2026-70474

The callback and refresh endpoints (/api/v1/oauth2-credential/callback and /api/v1/oauth2-credential/refresh) require no authentication whatsoever - they are explicitly whitelisted from JWT and API-key verification in constants.ts. The sole prerequisite for the unauthenticated token injection and refresh attacks is knowledge of a valid credential UUID from any workspace in the Flowise instance; UUIDs are not secret by design and may be exposed through other API responses, logs, or browser network traffic. The authorize endpoint (/api/v1/oauth2-credential/authorize/:id) requires a valid authenticated session (PR:L), but the credential lookup still performs no workspace scoping, so any authenticated user in any workspace can initiate flows against credentials belonging to other workspaces. Exploitation is limited to Flowise deployments that have OAuth2 credentials configured; deployments with no OAuth2 integrations have no exploitable credential objects.

The CVSS 4.0 score of 7.6 with vector AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N reflects the mixed nature of the attack surface: the AT:P (attack requirements present) captures the dependency on knowing a victim credential UUID, while PR:L acknowledges the authorize endpoint's authentication requirement. However, the CVSS vector does not fully represent the unauthenticated paths (callback and refresh), which are more dangerous and effectively PR:N since authentication is bypassed by whitelist. The practical risk is highest in multi-tenant or shared Flowise deployments where multiple workspaces coexist; single-tenant self-hosted instances have reduced exposure because a credential UUID belonging to the same deployment would not cross meaningful trust boundaries. No EPSS data was provided and no CISA KEV listing is present, meaning active exploitation is unconfirmed. The availability of detailed GHSA source-code evidence - including exact file paths and the correct vs. incorrect patterns - significantly lowers the bar for constructing a working exploit, elevating practical risk above what the score alone suggests for multi-tenant deployments.

An unauthenticated attacker who learns or enumerates a victim workspace's credential UUID - for example, through a prior information disclosure, insider access, or UUID prediction - sends a crafted HTTP request to /api/v1/oauth2-credential/callback?code=ATTACKER_AUTH_CODE&state=VICTIM_CREDENTIAL_UUID with an attacker-controlled OAuth2 authorization code; the server, bypassing all authentication checks via the whitelist, exchanges the attacker's code for tokens and overwrites the victim credential's stored access and refresh tokens, effectively hijacking the OAuth2-backed integration. The GHSA advisory provides exact endpoint patterns and the specific whitelist code responsible, substantially lowering the complexity for a motivated attacker.