Most recent entries from all

EUVD-2026-292956

2026-10-04T05:21:50.083311+00:00

EUVD-2026-292956

fkie_cve-2026-41273

2026-10-04T05:21:50.083383+00:00

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, Flowise contains an authentication bypass vulnerability that allows an unauthenticated attacker to obtain OAuth 2.0 access tokens associated with a public chatflow. By accessing a public chatflow configuration endpoint, an attacker can retrieve internal workflow data, including OAuth credential identifiers, which can then be used to refresh and obtain valid OAuth 2.0 access tokens without authentication. This vulnerability is fixed in 3.1.0.

GHSA-6f7g-v4pp-r667 — Flowise: Unauthenticated OAuth 2.0 Access Token Disclosure via Public Chatflow in Flowise

2026-10-04T05:21:50.083419+00:00

Affected: npm: flowise

### Summary Flowise contains an authentication bypass vulnerability that allows an unauthenticated attacker to obtain OAuth 2.0 access tokens associated with a public chatflow.

By accessing a public chatflow configuration endpoint, an attacker can retrieve internal workflow data, including OAuth credential identifiers, which can then be used to refresh and obtain valid OAuth 2.0 access tokens without authentication.

### Details Flowise is designed to allow public chatflows to be accessed by unauthenticated end users via public URLs or embedded widgets. As a result, `chatflowId` values are intentionally exposed to unauthenticated clients and must not be treated as secrets.

However, the endpoint `GET /api/v1/public-chatbotConfig/` returns internal `flowData` without authentication. The returned `flowData` includes workflow node definitions containing OAuth credential identifiers (`credential` field).

Separately, the endpoint `POST /api/v1/oauth2-credential/refresh/` allows OAuth. 2.0 tokens to be refreshed without authentication or authorization checks.

Because credential identifiers can be obtained from the unauthenticated public chatflow configuration endpoint, these two behaviors can be combined to allow unauthenticated OAuth 2.0 access token disclosure.

### PoC **Prerequisites** - Self-hosted Flowise instance - A public chatflow configured with an OAuth 2.0 credential (e.g., Gmail OAuth2)

#### Step 1: Obtain `chatflowId` The `chatflowId` is…

WID-SEC-W-2026-1145 — Flowise: Mehrere Schwachstellen

2026-10-04T05:21:50.083465+00:00

Ein Angreifer kann mehrere Schwachstellen in Flowise ausnutzen, um beliebigen Programmcode auszuführen, um Sicherheitsvorkehrungen zu umgehen, um Informationen offenzulegen, und um Dateien zu manipulieren.