CVE-2026-69250 Details
Description
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the OAuth2 token refresh endpoint POST /api/v1/oauth2-credential/refresh/:credentialId is unauthenticated by design and performs a server-side HTTP request to the credential-controlled accessTokenUrl without SSRF protections. Runtime validation confirmed that the endpoint was reachable without authentication, triggered outbound POST requests to an attacker-controlled server, reflected the full remote response body to the caller through tokenInfo, and sent client_id, client_secret, grant_type=refresh_token, and refresh_token in the request body. This issue is fixed in version 3.1.3.
A vulnerability exists in Flowise versions prior to 3.1.3, specifically in the OAuth2 token refresh endpoint, which is unauthenticated by design. This endpoint performs server-side HTTP requests to a user-controlled URL, 'accessTokenUrl', without proper safeguards against Server-Side Request Forgery (SSRF). The vulnerability allows for the exfiltration of sensitive information, including the 'client_id', 'client_secret', 'refresh_token', and other token-related data, to an attacker-controlled server. The issue has been addressed in version 3.1.3.
Users can update to Flowise version 3.1.3 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Aug 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-r745-8hwv-h473 | CISA-ADP | ExploitVendor Advisory |
| https://github.com/FlowiseAI/Flowise/commit/da8b251a9a4c59484ceaf6f71df7406aede7bef2 | [email protected] | Patch |
| https://github.com/FlowiseAI/Flowise/releases/tag/[email protected] | [email protected] | PatchRelease Notes |
| https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-r745-8hwv-h473 | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| flowiseai flowise | < 3.1.3 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 14, 2026 | Initial Analysis | [email protected] |
| Aug 4, 2026 | CVE Modified | CISA-ADP |
| Aug 4, 2026 | New CVE Received | [email protected] |