CVE-2026-70478

Summary

Flowise: Unauthenticated OAuth2 token refresh endpoint returns access tokens — enables token theft for any connected service

Severity

critical

EPSS

0.6% (p49)

CWE

CWE-200

Also known as

GHSA-qgvm-j2hm-6m38

Published

2026-08-04

Updated

2026-08-04

Advisory details

Summary

The OAuth2 token refresh endpoint (POST /api/v1/oauth2-credential/refresh/:credentialId) is in WHITELIST_URLS, meaning it requires no authentication. It decrypts the stored credential (containing clientId, clientSecret, refresh_token), sends a refresh request to the configured OAuth provider, and returns the new access_token directly in the response body.

Root Cause

// packages/server/src/routes/oauth2/index.ts:393-402
res.json({
    success: true,
    message: 'OAuth2 token refreshed successfully',
    credentialId: credential.id,
    tokenInfo: {
        ...tokenData,  // ← includes access_token!
        has_new_refresh_token: !!tokenData.refresh_token,
        expires_at: updatedCredentialData.expires_at
    }
})

Whitelist entry at packages/server/src/utils/constants.ts:40.

Attack Chain

1. Attacker obtains a credential ID (via Finding 2 / public chatflow leak, or enumeration)
2. Attacker calls POST /api/v1/oauth2-credential/refresh/:credentialId (no auth required)
3. Server decrypts credential, sends refresh request to OAuth provider with user's client_secret
4. Server returns the new access_token in the response to the attacker
5. Attacker uses the token to access the victim's connected service (Google, Microsoft, etc.)

Docker Validation

POST /api/v1/oauth2-credential/refresh/fake-uuid returns {"message":"Credential not found"} (not 401 Unauthorized), proving the endpoint processes the request without authentication.

Impact

• OAuth2 access token theft for any connected service
• Full access to the victim's third-party accounts (Google, Microsoft, GitHub, etc.)
• Client secret transmitted to OAuth provider during refresh
• Can also be used for DoS by exhausting refresh token quota

Suggested Fix

Remove the refresh endpoint from WHITELIST_URLS and require authentication:

// Remove from WHITELIST_URLS in constants.ts
// Add authentication check in the route handler

Credits

• Shinobi Security - https://github.com/shinobisecurity

References

• https://github.com/advisories/GHSA-qgvm-j2hm-6m38
• https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-qgvm-j2hm-6m38

Related advisories

• CVE-2026-70473 — high · npm/flowise
• GHSA-rwrp-9823-p2xq — medium · npm/flowise
• CVE-2026-73487 — critical · npm/flowise
• CVE-2026-73483 — critical · npm/flowise
• CVE-2026-70477 — critical · npm/flowise
• CVE-2026-69264 — critical · npm/flowise
• CVE-2026-70470 — critical · npm/flowise
• CVE-2026-69259 — critical · npm/flowise

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity