CVE-2026-70474: Incorrect Authorization and Missing Authentication in Flowise OAuth2 Credential Endpoints

Flowise is an open-source, drag-and-drop user interface designed to orchestrate and build custom Large Language Model (LLM) workflows. To connect with third-party APIs such as Microsoft Office 365, Google Workspace, or GitHub, Flowise utilizes OAuth2 credential configurations.

Prior to version 3.1.3, Flowise exposes three OAuth2 credential endpoints to severe security weaknesses. These endpoints do not properly restrict access based on the workspace partition of the requesting entity. Instead, they query the backend database using only the record-specific UUID.

Additionally, two of these endpoints are explicitly excluded from the global authentication pipeline. This design flaw permits unauthenticated remote attackers to perform unauthorized actions on stored credentials, potentially leading to third-party access token exfiltration.

The primary root cause of CVE-2026-70474 is a combination of missing database query scoping and insecure global route whitelisting. Within multi-tenant or workspace-isolated environments, standard security practices dictate that any resource query must bind to both the resource ID and the tenant context. In Flowise, the database schema contains a workspace identifier to enforce this separation.

However, in the vulnerable routes located in packages/server/src/routes/oauth2/index.ts, the application queries the Credential repository using only the credentialId or state identifier. The database schema's workspaceId attribute is completely ignored during lookups.

Simultaneously, the global route controller defines a whitelist pattern to permit seamless external OAuth2 callback interactions. The path prefixes /api/v1/oauth2-credential/callback and /api/v1/oauth2-credential/refresh bypass JWT verification entirely. Because the lookup does not validate the workspace context and the routes do not enforce authentication, any remote attacker can interact with arbitrary credential entries.

The vulnerable implementation in packages/server/src/routes/oauth2/index.ts queries the database repository directly with user-supplied identifiers without enforcing context restrictions. For example, the lookup in the authorize route is configured as follows:

// VULNERABLE
const credential = await credentialRepository.findOneBy({
    id: credentialId
})

The corresponding patch in Flowise version 3.1.3 remediates this behavior by enforcing workspace scoping. The lookup is modified to extract the active workspace ID directly from the authenticated session context:

// PATCHED
const credential = await credentialRepository.findOneBy({
    id: credentialId,
    workspaceId: req.user?.activeWorkspaceId
})

While the patch secures authenticated paths, developers must remain cautious. If TypeORM or similar Object-Relational Mappers receive an undefined value for activeWorkspaceId, they may silently strip the property from the query criteria. In such cases, the query reverts to lookup by id alone, which represents a potential validation bypass under specific configurations.

An attacker can exploit these weaknesses through three separate attack vectors depending on their level of access. The first vector involves an authenticated user in a low-privilege workspace querying the /authorize endpoint of another workspace's credential. If the attacker knows or guesses the target UUID, they can leak metadata, including the client ID and the requested scope.

The second vector involves unauthenticated token injection. Since the callback endpoint is whitelisted, an attacker can invoke /api/v1/oauth2-credential/callback?code=ATTACKER_CODE&state=VICTIM_UUID. Flowise will contact the external provider, exchange the attacker's code, and write the resulting token to the database under the victim's credential record, effectively hijacking the flow.

The third and most critical vector is unauthenticated token theft. By sending a POST request to /api/v1/oauth2-credential/refresh/VICTIM_UUID, an attacker triggers an automatic token refresh cycle. The server exchanges the stored refresh token for a new access token and returns the payload in the HTTP response body, granting the attacker direct API access to the victim's external third-party services.

The impact of CVE-2026-70474 is severe, particularly for enterprise deployments managing integrations with highly privileged third-party services. Because LLM orchestrators often require write access to corporate repositories, cloud storage, or communications channels, compromising an OAuth2 credential can lead to significant downstream compromises.

An attacker who successfully retrieves an active access token via the /refresh endpoint gains full API access under the context of the linked third-party account. This may facilitate data exfiltration, lateral movement within external systems, or unauthorized modification of production configurations.

The CVSS v4.0 score is calculated at 7.6, emphasizing the high impact on confidentiality and integrity. The risk is compounded by the ease of exploitation, as targeting whitelisted endpoints requires no authentication or specific session state.

The recommended remediation is to immediately upgrade the Flowise installation to version 3.1.3 or higher. This release integrates session-to-workspace checks on all critical database queries associated with the OAuth2 workflow.

If upgrading is not immediately possible, organizations should deploy temporary network-level controls. Administrators can configure Web Application Firewalls (WAF) to block external HTTP traffic targeting the /api/v1/oauth2-credential/refresh/ path prefix. Access should only be allowed from trusted internal networks or specific identity provider callback URLs.

Additionally, security teams should inspect the application's audit logs for anomalous POST requests on the refresh endpoints. Any unexpected authorization callback traffic or unknown state parameters should be treated as potential exploitation attempts. Credentials stored in vulnerable versions should be rotated to invalidate any potentially exfiltrated access tokens.