CVE-2026-70636 in Flowise
Summary
by MITRE • 08/07/2026
Flowise through 3.1.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to access the OAuth2 credential refresh endpoint by exploiting prefix-based whitelist matching in the authentication middleware defined in packages/server/src/utils/constants.ts. Attackers can send a POST request to the oauth2-credential refresh route with a trailing credential identifier to bypass all authentication and authorization checks, triggering unauthorized OAuth token rotation against credentials belonging to any workspace and potentially disrupting dependent OAuth integrations. This is a bypass of CVE-2026-41273.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/07/2026
The vulnerability in Flowise versions through 3.1.4 represents a critical authentication bypass flaw that undermines the security controls protecting sensitive OAuth2 credential operations. This issue stems from improper implementation of access control mechanisms within the application's authentication middleware, specifically targeting the oauth2-credential refresh endpoint. The flaw allows unauthenticated attackers to circumvent all security checks by exploiting a prefix-based whitelist matching approach that fails to properly validate request parameters. The vulnerability exists in the packages/server/src/utils/constants.ts file where the authentication logic is configured, creating a pathway for malicious actors to gain unauthorized access to credential management functions.
The technical execution of this attack relies on the specific implementation of the authentication middleware's whitelist validation process. When an attacker sends a POST request to the oauth2-credential refresh route, they can append a trailing credential identifier that matches the prefix-based validation logic without triggering proper authentication requirements. This design flaw allows the system to accept requests that should require valid authentication tokens or authorization headers, effectively granting access to any workspace's OAuth credentials regardless of the user's authenticated status. The vulnerability demonstrates poor input sanitization and validation practices that enable parameter manipulation to bypass security controls.
The operational impact of this vulnerability extends beyond simple unauthorized access, potentially causing significant disruption to integrated services that depend on OAuth authentication. Attackers can perform unauthorized OAuth token rotations against credentials belonging to any workspace within the system, which could lead to compromised integrations with external services that rely on these tokens for authentication and authorization. This unauthorized activity may result in data exposure, service interruption, or potential compromise of connected third-party applications that trust the affected Flowise instance. The disruption to dependent OAuth integrations could cascade through interconnected systems, amplifying the overall security impact.
This vulnerability aligns with CWE-285, which addresses improper authorization issues in software systems, and demonstrates characteristics consistent with ATT&CK technique T1078 for valid accounts usage. The authentication bypass mechanism specifically targets the application's credential management functionality, allowing attackers to manipulate OAuth tokens without proper authorization. Organizations using Flowise versions through 3.1.4 should immediately implement mitigations including patching to the latest version, implementing additional request validation layers, and reviewing all authentication middleware configurations. The fix for CVE-2026-41273 addresses this specific bypass by strengthening the authentication validation logic to prevent prefix-based matching attacks. Security teams must also consider implementing network-level restrictions on sensitive endpoints and monitoring for unusual credential refresh patterns that could indicate exploitation attempts.
The root cause analysis reveals that the vulnerability stems from inadequate security controls in the authentication middleware configuration, specifically failing to implement proper parameter validation or request integrity checks. The system's reliance on prefix-based matching without sufficient context validation creates an attack surface where malicious input can be accepted as legitimate. This flaw represents a classic example of insufficient input validation and authorization enforcement that enables attackers to manipulate application flow control. Organizations should conduct comprehensive security reviews of their authentication systems to identify similar patterns that could lead to unauthorized access, particularly focusing on how middleware components handle parameter validation and access control decisions.