GHSA-6f7g-v4pp-r667 CVE-2026-41273

Flowise: Unauthenticated OAuth 2.0 Access Token Disclosure via Public Chatflow in Flowise

High npm

Severity: 0.0 / 10; High · CVSS 4.0
Exploit chance (EPSS): 0.31%; Chance of exploitation in the next 30 days. Higher than 23.65% of scored vulnerabilities.
Known exploited: No; Not in CISA's catalog
Weakness: CWE-306 Missing Authentication for Critical Function
Fix: 3.1.0; Upgrade flowise to this version or later

Description

Summary

Flowise contains an authentication bypass vulnerability that allows an unauthenticated attacker to obtain OAuth 2.0 access tokens associated with a public chatflow.

By accessing a public chatflow configuration endpoint, an attacker can retrieve internal workflow data, including OAuth credential identifiers, which can then be used to refresh and obtain valid OAuth 2.0 access tokens without authentication.

Details

Flowise is designed to allow public chatflows to be accessed by unauthenticated end users via public URLs or embedded widgets. As a result, chatflowId values are intentionally exposed to unauthenticated clients and must not be treated as secrets.

However, the endpoint GET /api/v1/public-chatbotConfig/<chatflowId> returns internal flowData without authentication. The returned flowData includes workflow node definitions containing OAuth credential identifiers (credential field).

Separately, the endpoint POST /api/v1/oauth2-credential/refresh/<credentialId> allows OAuth. 2.0 tokens to be refreshed without authentication or authorization checks.

Because credential identifiers can be obtained from the unauthenticated public chatflow configuration endpoint, these two behaviors can be combined to allow unauthenticated OAuth 2.0 access token disclosure.

PoC

Prerequisites

Self-hosted Flowise instance
A public chatflow configured with an OAuth 2.0 credential (e.g., Gmail OAuth2)

Step 1: Obtain `chatflowId`

The chatflowId is exposed to unauthenticated users via public chatflow URLs, embedded widgets, or browser network requests when accessing a public chatflow.

Example: d37b9812-72c1-4c64-b152-665f307f755e

Step 2: Retrieve internal `flowData` without authentication

curl -s \
  http://localhost:3000/api/v1/public-chatbotConfig/d37b9812-72c1-4c64-b152-665f307f755e

The response includes flowData containing an OAuth credential identifier, for example:

"credential": "6efe0e20-ba6f-4fbb-9960-658feffa0542"

Step 3: Refresh OAuth 2.0 token without authentication

curl -X POST \
  http://localhost:3000/api/v1/oauth2-credential/refresh/6efe0e20-ba6f-4fbb-9960-658feffa0542

The response returns valid OAuth 2.0 access token data, including an access_token.

Impact

An unauthenticated attacker can obtain OAuth 2.0 access tokens for third-party services configured in Flowise, potentially leading to unauthorized data access, API abuse, or account compromise.

This vulnerability affects self-hosted deployments because public chatflows are commonly exposed to the internet and require unauthenticated access by design. Treating chatflowId as a secret does not mitigate the issue.

Affected versions

npm

Package	Vulnerable	Fixed in
flowise	`< 3.1.0`	`3.1.0`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

flowise npm → `3.1.0`

npm

npm install flowise@3.1.0

yarn

yarn add flowise@3.1.0

pnpm

pnpm add flowise@3.1.0

Severity breakdown

CVSS 4.0 0.0

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:H/SI:N/SA:N

Attack vector: Network
Attack complexity: Low
Attack requirements: None
Privileges required: None
User interaction: None
Confidentiality (vulnerable system): None
Integrity (vulnerable system): Low
Availability (vulnerable system): None
Confidentiality (subsequent systems): High
Integrity (subsequent systems): None
Availability (subsequent systems): None

CVSS 3.1 8.2

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: Low
Availability: None

Weakness

CWE-306: Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

How to prevent it

Architecture and Design: Divide the software into anonymous, normal, privileged, and administrative areas. Identify which of these areas require a proven user identity, and use a centralized authentication capability. Identify all potential communication channels, or other means of interaction with the software, to ensure that all channels are appropriately protected, including those channels that are assumed to be accessible only by authorized parties. Developers sometimes perform authentication at the primary channel, but open up a secondary channel that is assumed to be private. For example, a login mechanism may be listening on one network port, but after successful authentication, it may open up a second port where it waits for the connection, but avoids authentication because it assumes that only the authenticated party will connect to the port. In general, if the software or protocol allows a single session or user state to persist across multiple connections or channels, authentication and appropriate credential management need to be used throughout.
Architecture and Design: For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.
Architecture and Design: Where possible, avoid implementing custom, "grow-your-own" authentication routines and consider using authentication capabilities as provided by the surrounding framework, operating system, or environment. These capabilities may avoid common weaknesses that are unique to authentication; support automatic auditing and tracking; and make it easier to provide a clear separation between authentication tasks and authorization tasks. In environments such as the World Wide Web, the line between authentication and authorization is sometimes blurred. If custom authentication routines are required instead of those provided by the server, then these routines must be applied to every single page, since these pages could be requested directly.
Architecture and Design: Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. For example, consider using libraries with authentication capabilities such as OpenSSL or the ESAPI Authenticator [REF-45].
Implementation, System Configuration, Operation: When storing data in the cloud (e.g., S3 buckets, Azure blobs, Google Cloud Storage, etc.), use the provider's controls to require strong authentication for users who should be allowed to access the data [REF-1297] [REF-1298] [REF-1302].

References

Advisories

nvd.nist.gov/vuln/detail/CVE-2026-41273

Packages

github.com/FlowiseAI/Flowise

Timeline

Apr 16, 2026 Published
Oct 26, 2026 Last updated by the source
Oct 31, 2026 Latest EPSS score

Advisory	Severity	Why it's related
GHSA-w7x8-q2gp-5cgg Flowise Prompt Injection to RCE and SSRF via CSV/Airtable Agent Python Validator Bypass	Critical	Also affects flowise
GHSA-9gvv-qjj3-2p6g Flowise NodeVM sandbox escape via puppeteer allowlist - authenticated RCE and arbitrary file read via Chromium	High	Also affects flowise
GHSA-qgvm-j2hm-6m38 Flowise: Unauthenticated OAuth2 token refresh endpoint returns access tokens — enables token theft for any connected service	Critical	Also affects flowise
GHSA-5xvg-pmgg-3mxr Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability	Critical	Also affects flowise
GHSA-gmmw-qg98-6j6p Flowise: Broken Access Control in Stripe Subscription Endpoints Allows Cross-Tenant Billing Manipulation	High	Also affects flowise
GHSA-8gj2-2cvc-6xx7 Flowise: Unauthenticated Credential Abuse via Text-to-Speech Endpoint Allows Unauthorized Use of Private Chatflow TTS Credentials	Medium	Also affects flowise
GHSA-fm2f-4339-4p2f Flowise: Missing Authorization on Execution Update Endpoint	Medium	Also affects flowise
GHSA-wch5-xp77-fxg4 Flowise: Cross-Workspace OAuth2 Credential Metadata Leak	High	Also affects flowise

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor