Flowise OAuth2 refresh endpoint flaw exposed tokens and bypassed authentication

Flowise fixed two closely related flaws in its OAuth2 credential refresh functionality that allowed unauthenticated access to POST /api/v1/oauth2-credential/refresh/:credentialId. In versions before 3.1.3, tracked as CVE-2026-70478, the endpoint was placed in WHITELIST_URLS without authentication, letting an attacker who knew a credential ID decrypt stored OAuth details, trigger a refresh with the provider, and receive the new access token in the response. The issue exposed connected third-party services to token theft and could also be abused to consume refresh-token quotas.

A follow-on bug, CVE-2026-70636, showed the earlier fix was incomplete and that Flowise through 3.1.4 still allowed authentication bypass through prefix-based whitelist matching. Researchers reported that crafted requests with a trailing credential identifier could still reach the refresh handler, which refreshed and updated OAuth credentials without validating caller identity, workspace ownership, or RBAC permissions. The flaw enabled cross-workspace token rotation and unauthorized mutation of credential state, and was described as a bypass of an earlier remediation tied to GHSA-6f7g-v4pp-r667.