Executive brief
Flowise, an open-source tool for building LLM applications, contains a security flaw in how it handles OAuth2 credential updates. An attacker can trick the system into sending sensitive internal secrets, such as client IDs and passwords, to a server they control. This could allow unauthorized access to third-party services integrated with the platform or provide a foothold to probe the organization's internal network.
Technical details
The OAuth2 token refresh endpoint (`/api/v1/oauth2-credential/refresh/:credentialId`) is included in a public whitelist, allowing unauthenticated access. When triggered, the application performs a server-side POST request using the `accessTokenUrl` stored in the credential's configuration without adequate SSRF protections. An attacker who knows a valid credential UUID can trigger this request, causing the server to send `client_id`, `client_secret`, and `refresh_token` to an arbitrary URL. Because the application reflects the full remote response body in the `tokenInfo` field, this is a non-blind SSRF that can also be used to map internal network services. The issue is fixed in version 3.1.3.
Affected products
- FlowiseAI flowise <= 3.1.2
Timeline
- 2026-07-29: disclosed
- 2026-08-04: advisory
- 2026-08-04: patched