CVE-2026-70478: Flowise: Unauthenticated OAuth2 token refresh endpoint returns access tokens — enables token theft for any connected service

The route POST /api/v1/oauth2-credential/refresh/:credentialId is listed in WHITELIST_URLS (packages/server/src/utils/constants.ts), so the auth middleware skips it. The handler in packages/server/src/routes/oauth2/index.ts decrypts the stored credential, which holds clientId, clientSecret and refresh_token. It sends a refresh request to the OAuth provider and returns the result to the caller. The JSON response spreads tokenData into tokenInfo, and that includes the new access_token.

The attacker needs a credential ID. The advisory says it can come from a public chatflow leak (its Finding 2, not described here) or from enumeration. With the ID, one unauthenticated request yields a live token for the victim's connected account. The researcher checked the missing authentication in Docker: a request with a fake ID returned Credential not found instead of 401.

The advisory lists these consequences: theft of OAuth2 access tokens for any connected service, access to the victim's third-party accounts, and denial of service by using up the refresh quota. The vector shows network access, no privileges and no user interaction, with high confidentiality impact.

The flowise npm package, version 3.1.2 and earlier. Only instances that store OAuth2 credentials are worth worrying about, but the endpoint is open on every instance. Check the version:

npm ls flowise

To test your own server, send a POST to the refresh path with a made-up ID. A Credential not found reply, rather than 401, shows the route is reachable without a login.

Upgrade flowise to 3.1.3.

npm install -g [email protected]

The advisory's suggested fix is to remove the refresh route from WHITELIST_URLS and require authentication in the handler. After upgrading, revoke and reissue OAuth2 tokens for connected services if the instance was reachable from untrusted networks. Until then, block /api/v1/oauth2-credential/refresh/ at your reverse proxy.

Check access logs for POST requests to /api/v1/oauth2-credential/refresh/ that carry no session or API key, or that come from addresses you do not recognize. Many requests with different IDs suggest enumeration. At the OAuth provider (Google, Microsoft, GitHub), review token refresh and sign-in activity for the connected account around those times, and look for access from unusual IP addresses. A response body containing OAuth2 token refreshed successfully sent to an unauthenticated client is the successful case.

Summary

The OAuth2 token refresh endpoint (POST /api/v1/oauth2-credential/refresh/:credentialId) is in WHITELIST_URLS, meaning it requires no authentication. It decrypts the stored credential (containing clientId, clientSecret, refresh_token), sends a refresh request to the configured OAuth provider, and returns the new access_token directly in the response body.

Root Cause

// packages/server/src/routes/oauth2/index.ts:393-402
res.json({
    success: true,
    message: 'OAuth2 token refreshed successfully',
    credentialId: credential.id,
    tokenInfo: {
        ...tokenData,  // ← includes access_token!
        has_new_refresh_token: !!tokenData.refresh_token,
        expires_at: updatedCredentialData.expires_at
    }
})

Whitelist entry at packages/server/src/utils/constants.ts:40.

Attack Chain

1. Attacker obtains a credential ID (via Finding 2 / public chatflow leak, or enumeration)
2. Attacker calls POST /api/v1/oauth2-credential/refresh/:credentialId (no auth required)
3. Server decrypts credential, sends refresh request to OAuth provider with user's client_secret
4. Server returns the new access_token in the response to the attacker
5. Attacker uses the token to access the victim's connected service (Google, Microsoft, etc.)

Docker Validation

POST /api/v1/oauth2-credential/refresh/fake-uuid returns {"message":"Credential not found"} (not 401 Unauthorized), proving the endpoint processes the request without authentication.

Impact

• OAuth2 access token theft for any connected service
• Full access to the victim's third-party accounts (Google, Microsoft, GitHub, etc.)
• Client secret transmitted to OAuth provider during refresh
• Can also be used for DoS by exhausting refresh token quota

Suggested Fix

Remove the refresh endpoint from WHITELIST_URLS and require authentication:

// Remove from WHITELIST_URLS in constants.ts
// Add authentication check in the route handler

---

Credits

• Shinobi Security - https://github.com/shinobisecurity