Skip to content
AI Sec Watch
HighVulnerability

GHSA-5fw2-mwhh-9947: Flowise: Unauthenticated TTS endpoint accepts arbitrary credential IDs — enables API credit abuse via stored credentials

Source
GitHub Advisory(opens in a new tab)
Identifier
GHSA-5fw2-mwhh-9947
Published
Record updated
View JSON
Affected
  • flowise <= 3.0.13
Fixed in
3.1.0

Summary

The text-to-speech generate endpoint in Flowise, POST /api/v1/text-to-speech/generate, is whitelisted and requires no authentication. When called without a chatflowId, it takes an attacker-supplied credentialId from the request body and uses the stored credential, such as an OpenAI or ElevenLabs API key, to generate speech. An unauthenticated attacker can therefore spend a victim's API credits, and the source says this is trivially exploitable when combined with a credential ID leak described in Finding 2.

Mitigation

The source suggests removing the TTS endpoint from WHITELIST_URLS, or validating that the credential belongs to the chatflow being used. It proposes returning a 401 'Authentication required' response when no chatflowId is provided.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

Related items