{"data":{"id":"15aa1daf-db37-4a20-aef1-32ed6ab70d05","title":"GHSA-qgvm-j2hm-6m38: Flowise: Unauthenticated OAuth2 token refresh endpoint returns access tokens — enables token theft for any connected service","summary":"Flowise has a security flaw where an unauthenticated endpoint (`POST /api/v1/oauth2-credential/refresh/:credentialId`) can refresh OAuth2 tokens (credentials that allow apps to act on behalf of a user) without requiring login. An attacker who knows a credential ID can call this endpoint to get a fresh access token and use it to impersonate the victim on connected services like Google or Microsoft.","solution":"Remove the refresh endpoint from `WHITELIST_URLS` in `packages/server/src/utils/constants.ts` and add an authentication check to the route handler in `packages/server/src/routes/oauth2/index.ts` to require login before allowing token refresh.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-qgvm-j2hm-6m38","publishedAt":"2026-08-04T19:37:36.000Z","cveId":"CVE-2026-70478","cweIds":null,"cvssScore":null,"cvssSeverity":"critical","severity":"critical","attackType":["supply_chain"],"issueType":"vulnerability","affectedPackages":["flowise@<= 3.1.2 (fixed: 3.1.3)"],"affectedVendors":[],"affectedVendorsRaw":["Flowise"],"classifierModel":"claude-haiku-4-5-20251001","classifierPromptVersion":"v3","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0,"patchAvailable":true,"disclosureDate":"2026-08-04T19:37:36.000Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity"],"aiComponentTargeted":"api","llmSpecific":false,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":["AML.T0010"]}}