Loading vulnerability…
Flowise Unauthenticated OAuth Token Refresh
Flowise versions earlier than 3.1.3 expose an OAuth2 credential-refresh API route without authentication because it is placed on the unauthenticated route whitelist. Given a valid stored credential identifier, the route decrypts the associated OAuth credential, submits its client secret and refresh token to the configured OAuth provider, and returns the resulting access token to the requester.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An unauthenticated attacker can obtain a usable OAuth access token for a victim's connected third-party service and act within the permissions granted to that token. Repeated requests may also consume or exhaust the OAuth provider's refresh-token quota, causing denial of service for the affected integration.
If you can’t patch tonight, do this now.
Until upgraded, remove the OAuth credential-refresh route from the unauthenticated whitelist and enforce authentication and authorization checks before processing refresh requests. Restrict network access to the Flowise API and rotate or revoke potentially exposed OAuth credentials and tokens.
Patch, then assume compromise.
Upgrade Flowise to version 3.1.3 or later. The fixed release removes the unauthenticated exposure of the OAuth credential-refresh functionality.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.