EUVD-2026-52912
GHSA-qgvm-j2hm-6m38
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDiscover internet-exposed Flowise instance
-
DeliveryObtain valid credentialId via chatflow leak or enumeration
-
ExploitPOST unauthenticated /oauth2-credential/refresh/:id
-
ExecutionServer refreshes and returns access_token
-
PersistReplay token against victim's Google/Microsoft/GitHub account
-
ImpactExfiltrate victim third-party data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires only network reachability to the Flowise HTTP API and knowledge of a valid credentialId; the refresh endpoint is in WHITELIST_URLS, so no authentication, session, or user interaction is needed against default configurations of Flowise <= 3.1.2. The single limiting factor is the credentialId: an invalid or unknown ID returns 'Credential not found', so the attacker must first obtain a real ID (leaked via a public chatflow, exposed elsewhere in the app, or brute-forced/enumerated), and the targeted credential must be an OAuth2 credential with a still-valid refresh_token for the refresh to yield a usable access_token. There is no non-default-configuration requirement - the vulnerable whitelist entry ships by default. |
| Impact | The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N, base 9.2) is internally consistent with the description: network-reachable, low complexity, no privileges or user interaction, high confidentiality impact on both the vulnerable system and a subsequent system (the victim's connected third-party accounts). The one real gating factor is knowledge of a valid credentialId - the Docker test confirms an invalid ID returns 'Credential not found' rather than 401, proving the auth bypass but also showing a valid identifier is a prerequisite; the researcher notes IDs can leak via public chatflows or be enumerated, which is not reflected as added complexity in the score. No CISA KEV listing and no EPSS score were provided, so widespread active exploitation is not established; treat this as a patch-now issue on exposure grounds (trivial exploitation, high-value token theft) rather than one with confirmed in-the-wild activity. Because the fixed release (3.1.3) exists and the flaw is a simple whitelist/auth omission, remediation risk is low and prioritization should be high wherever Flowise is internet-reachable or holds OAuth2 credentials. |
| Exploit ScenarioDerived | An attacker who obtains a credentialId - for example from a publicly shared or leaked chatflow, or by enumeration - sends a single unauthenticated POST /api/v1/oauth2-credential/refresh/<credentialId> to an internet-exposed Flowise server. The server decrypts the stored credential, refreshes it against the OAuth provider using the victim's client secret, and returns the live access_token, which the attacker replays to read the victim's Google/Microsoft/GitHub data. The low-complexity, no-auth, no-interaction network vector makes this a single-request attack; no public exploit code is published, but the disclosure includes a working Docker validation of the auth bypass. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Aug 04, 2026
Unauthenticated OAuth2 access-token theft in Flowise (npm/flowise <= 3.1.2) stems from the token-refresh endpoint POST /api/v1/oauth2-credential/refresh/:credentialId being listed in WHITELIST_URLS, so it bypasses authentication entirely. Any remote party who knows or guesses a credential ID can force the server to decrypt the stored OAuth2 credential, refresh it against the provider using the victim's client secret, and receive the fresh access_token directly in the response body. No public exploit code has been identified, but the researcher (Shinobi Security) validated the missing-auth behavior in Docker, and a vendor-released patch is available in 3.1.3.
Earlier versions of this analysis (1)
OAuth2 access-token disclosure in Flowise (npm package flowise) versions <= 3.1.2 allows unauthenticated remote attackers to steal live access tokens for any third-party service a victim has connected. The token-refresh endpoint POST /api/v1/oauth2-credential/refresh/:credentialId is registered in WHITELIST_URLS, so it bypasses authentication, decrypts the stored credential, refreshes the token with the OAuth provider, and returns the fresh access_token in the response body. The fix landed in 3.1.3; publicly available exploit detail exists in the GitHub advisory, but no public exploit identified at time of analysis as a packaged tool, and there is no CISA KEV listing or EPSS data provided.
RemediationAI
Vendor-released patch: 3.1.3 - upgrade Flowise to 3.1.3 or later, which removes the refresh endpoint from the unauthenticated whitelist per GHSA-qgvm-j2hm-6m38 (https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-qgvm-j2hm-6m38). If you cannot upgrade immediately, apply the researcher's fix directly by removing the /api/v1/oauth2-credential/refresh/:credentialId entry from WHITELIST_URLS in packages/server/src/utils/constants.ts and adding an authentication/ownership check in the route handler, or block the /api/v1/oauth2-credential/refresh/ path at a reverse proxy or WAF so it is unreachable without a session - note this breaks legitimate token refresh for clients that rely on the endpoint and may force nodes to re-authenticate their OAuth2 connections. As additional interim controls, take the Flowise instance off the public internet (bind to localhost or restrict by IP/VPN), and rotate any OAuth2 credentials that may already have been exposed, since token theft leaves no obvious trace.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in npm
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Flowise is a Node.js/TypeScript low-code platform for building LLM agents and chatflows; it stores third-party OAuth2 credentials (clientId, clientSecret, refresh_token) encrypted at rest so connected nodes can call services like Google, Microsoft, and GitHub. The refresh route in packages/server/src/routes/oauth2/index.ts is meant to renew expired tokens, but its path is registered in the WHITELIST_URLS array (packages/server/src/utils/constants.ts:40) that the authentication middleware skips. The root cause maps to CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor): the handler decrypts the credential and spreads the full tokenData - including access_token - into the JSON response (index.ts:393-402) with no caller authorization or ownership check, so secrets meant to stay server-side are handed to the requester.
Know when Docker gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N
Unauthenticated single network request (AV:N/AC:L/PR:N/UI:N) steals tokens for a separate service, so S:C with C:H; only minor token-state change written, so I:L and A:N.
Primary rating from Vendor (https://github.com/FlowiseAI/Flowise).
CVSS VectorVendor: https://github.com/FlowiseAI/Flowise
Lifecycle Timeline
3DescriptionCVE.org
Summary
The OAuth2 token refresh endpoint (POST /api/v1/oauth2-credential/refresh/:credentialId) is in WHITELIST_URLS, meaning it requires no authentication. It decrypts the stored credential (containing clientId, clientSecret, refresh_token), sends a refresh request to the configured OAuth provider, and returns the new access_token directly in the response body.
Root Cause
// packages/server/src/routes/oauth2/index.ts:393-402
res.json({
success: true,
message: 'OAuth2 token refreshed successfully',
credentialId: credential.id,
tokenInfo: {
...tokenData, // ← includes access_token!
has_new_refresh_token: !!tokenData.refresh_token,
expires_at: updatedCredentialData.expires_at
}
})Whitelist entry at packages/server/src/utils/constants.ts:40.
Attack Chain
- Attacker obtains a credential ID (via Finding 2 / public chatflow leak, or enumeration)
- Attacker calls
POST /api/v1/oauth2-credential/refresh/:credentialId(no auth required) - Server decrypts credential, sends refresh request to OAuth provider with user's
client_secret - Server returns the new
access_tokenin the response to the attacker - Attacker uses the token to access the victim's connected service (Google, Microsoft, etc.)
Docker Validation
POST /api/v1/oauth2-credential/refresh/fake-uuid returns {"message":"Credential not found"} (not 401 Unauthorized), proving the endpoint processes the request without authentication.
Impact
- OAuth2 access token theft for any connected service
- Full access to the victim's third-party accounts (Google, Microsoft, GitHub, etc.)
- Client secret transmitted to OAuth provider during refresh
- Can also be used for DoS by exhausting refresh token quota
Suggested Fix
Remove the refresh endpoint from WHITELIST_URLS and require authentication:
// Remove from WHITELIST_URLS in constants.ts
// Add authentication check in the route handler---
Credits
- Shinobi Security - https://github.com/shinobisecurity
Articles & Coverage 1
Executive ViewAI
Flowise versions 3.1.2 and earlier contain a critical unauthenticated token theft vulnerability in the OAuth2 refresh endpoint, allowing attackers without credentials to steal access tokens from integrated services. Organizations using Flowise with OAuth2 connections face immediate risk of account compromise and unauthorized access to downstream systems.
Apply vendor patch. Upgrade to Flowise 3.1.3 or later.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
An issue was discovered in Appsmith before 1.52. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl
runc through version 1.0-rc6 (used in Docker before 18.09.2) contains a container escape vulnerability that allows attac
Netmaker makes networks with WireGuard. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no a
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
The News & Blog Designer Pack - WordPress Blog Plugin - (Blog Post Grid, Blog Post Slider, Blog Post Carousel, Blog Post
Path traversal in JFrog Artifactory (CWE-22) enables an authenticated low-privilege user to write data outside the inten
Docker 1.3.2 allows remote attackers to execute arbitrary code with root privileges via a crafted (1) image or (2) build
Remote code execution in Gogs through 0.14.2 allows authenticated users (and unauthenticated attackers on default-config
Unauthenticated remote command injection in SGWBOX N3 firmware 2.0.25 lets attackers execute arbitrary operating-system
Remote code execution in Flowise before 3.1.2 allows any authenticated user (or API caller with chatflow view/update per
Remote code execution in NocoBase Workflow Script Node (npm @nocobase/plugin-workflow-javascript) allows authenticated l
Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by placing a Trojan horse docker-c
Exploit-DB