CVE-2026-70636

HIGH 7.5

Flowise 3.1.4 Authentication Bypass via OAuth2 Credential Refresh Endpoint

CVSS Score

7.5

EPSS Score

0.0%

EPSS Percentile

0th

Flowise through 3.1.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to access the OAuth2 credential refresh endpoint by exploiting prefix-based whitelist matching in the authentication middleware defined in packages/server/src/utils/constants.ts. Attackers can send a POST request to the oauth2-credential refresh route with a trailing credential identifier to bypass all authentication and authorization checks, triggering unauthorized OAuth token rotation against credentials belonging to any workspace and potentially disrupting dependent OAuth integrations. This is a bypass of CVE-2026-41273.

CWE	CWE-862
Vendor	flowiseai
Product	flowise
Published	Aug 6, 2026

Stay Ahead of the Next One

Get instant alerts for flowiseai flowise

Be the first to know when new high vulnerabilities affecting flowiseai flowise are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Affected Versions

FlowiseAI / Flowise

0 ≤ 3.1.4

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/Caycon/cve-advisories/blob/main/2026/Flowise/CVE-2026-70636.md flowiseai.com: https://flowiseai.com/sunset

Credits

CayCon, piropatriot