GHSA-r745-8hwv-h473: Flowise: Unauthenticated OAuth2 Refresh Enables Non-Blind SSRF and Secret Exfiltration

Flowise has a vulnerability where the OAuth2 token refresh endpoint is publicly accessible without authentication and makes server-side HTTP requests to attacker-controlled URLs without protections (SSRF, or server-side request forgery, where an attacker tricks a server into making requests on their behalf). This allows attackers to see the full response from their target server and steal sensitive OAuth2 secrets like client IDs and refresh tokens that get sent in the request body.