{"data":{"id":"714c15de-bf71-4af3-bf52-5d4177fb3b2d","title":"GHSA-r745-8hwv-h473: Flowise: Unauthenticated OAuth2 Refresh Enables Non-Blind SSRF and Secret Exfiltration","summary":"Flowise's unauthenticated OAuth2 token refresh endpoint, POST /api/v1/oauth2-credential/refresh/:credentialId, makes a server-side request to the credential's accessTokenUrl without SSRF protections, because the path is on the public whitelist. The response body is returned to the caller in tokenInfo, and the request carries client_id, client_secret and refresh_token, so an attacker who controls accessTokenUrl can read the target's response and capture those secrets. The advisory's proof of concept was run against flowiseai/flowise:latest, and the write-up states impact under the attacker-controlled-URL precondition.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-r745-8hwv-h473","publishedAt":"2026-08-04T14:20:49.000Z","cveId":"CVE-2026-69250","cweIds":null,"cvssScore":null,"cvssSeverity":"high","severity":"high","attackType":["supply_chain"],"issueType":"vulnerability","affectedPackages":["flowise@<= 3.1.2 (fixed: 3.1.3)"],"affectedPackageNames":["flowise"],"affectedPackageRefs":["npm:flowise"],"affectedVendors":[],"affectedVendorsRaw":["Flowise"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00573,"epssCheckedAt":"2026-11-04T12:08:33.171Z","kevDateAdded":null,"advisoryAliases":["GHSA-r745-8hwv-h473"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-08-04T14:20:49.000Z","fixReleasedAt":"2026-06-25T10:41:14.612Z","daysToFix":-40,"fixCheckedAt":"2026-10-29T21:32:25.983Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality"],"aiComponentTargeted":"plugin","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":["AML.T0010"],"fixes":[{"ecosystem":"npm","name":"flowise","fixedVersion":"3.1.3","matchedVersion":"3.1.3","fixReleasedAt":"2026-06-25T10:41:14.612Z","daysToFix":-40,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:32:25.836Z"}]}}