Flowise OAuth2 Refresh Endpoint Leaks Access Tokens to Unauthenticated Attackers (CVE-2026-70478)

A newly published GitHub Security Advisory (GHSA-qgvm-j2hm-6m38, tracked as CVE-2026-70478) reports that Flowise's OAuth2 token refresh endpoint, POST /api/v1/oauth2-credential/refresh/:credentialId, is listed in the application's WHITELIST_URLS and therefore requires no authentication. According to the researchers (credited to Shinobi Security), any caller who supplies a valid credential ID can trigger the server to decrypt the stored OAuth2 credential — including clientId, clientSecret, and refresh_token — send a refresh request to the configured OAuth provider, and receive the resulting access_token directly in the JSON response.

Why It Matters

Flowise is an open-source low-code platform for building LLM workflows, and OAuth2 credentials configured within it are used to connect to third-party services such as Google, Microsoft, or GitHub. If an attacker can obtain or enumerate a credential ID — the advisory notes this could come from a separate public chatflow leak finding or ID enumeration — this flaw allows them to mint a fresh access token for the victim's connected account without ever authenticating to Flowise itself. That amounts to full unauthorized access to whatever third-party service the credential is tied to, and the advisory also flags a secondary denial-of-service risk from exhausting the provider's refresh token quota.

What Defenders Should Do Now

• Identify any self-hosted Flowise instances in your environment and check the version against the vendor's fix once available; the advisory's suggested remediation is removing this route from WHITELIST_URLS and enforcing authentication on it.
• Review network exposure of Flowise deployments — internet-facing instances are at highest risk since the endpoint requires no credentials to reach.
• Audit logs for repeated or anomalous calls to /api/v1/oauth2-credential/refresh/*, especially requests with unfamiliar or sequential credential IDs and no prior authenticated session.
• Treat any OAuth2 credentials stored in Flowise as potentially exposed; consider rotating client secrets and refresh tokens for connected services as a precaution.
• Restrict or disable public/unauthenticated access to Flowise chatflows, since the advisory suggests credential IDs may be discoverable through leaked chatflow data.

This is developing, same-day intel based on a public GHSA disclosure with a public proof-of-concept validated against a Docker deployment; details may be updated as the vendor issues a fix and more information becomes available. Read the full advisory at GHSA-qgvm-j2hm-6m38.