GHSA-r745-8hwv-h473: Flowise: Unauthenticated OAuth2 Refresh Enables Non-Blind SSRF and Secret Exfiltration

Summary

Flowise's unauthenticated OAuth2 token refresh endpoint, POST /api/v1/oauth2-credential/refresh/:credentialId, makes a server-side request to the credential's accessTokenUrl without SSRF protections, because the path is on the public whitelist. The response body is returned to the caller in tokenInfo, and the request carries client_id, client_secret and refresh_token, so an attacker who controls accessTokenUrl can read the target's response and capture those secrets. The advisory's proof of concept was run against flowiseai/flowise:latest, and the write-up states impact under the attacker-controlled-URL precondition.

Mitigation

The source does not state a fix yet. Check the original advisory for updates.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• flowisenpmLLM dependency since 2024-03-12

Related items

• MediumResearchers Uncover Prompt Adware Hidden in OpenAI Codex Jailbreak ToolkitSimilar attack · The Hacker News
• InfoTop agent skill security resources — November 2026Similar attack · Adversa AI Blog
• HighCVE-2026-118627: MLflow SHAP load_explainer untrusted deserialization enables code executionSimilar attack · NVD/CVE Database
• HighCVE-2026-118623: MLflow PickleEvaluationArtifact remote code execution via untrusted pickleSimilar attack · NVD/CVE Database
• HighCVE-2026-88968: Claude Code Edit tool symlink race overwrites files outside workspace on macOSSimilar attack · NVD/CVE Database