Executive brief
Flowise, a tool used for building LLM applications, contains a vulnerability in how it handles OAuth2 credentials across different workspaces. An attacker can exploit this to steal sensitive access tokens for third-party services (like Google or Microsoft) or overwrite existing credentials without needing to log in. This could lead to unauthorized access to corporate data stored in connected services and disrupt automated workflows.
Technical details
The vulnerability exists in the OAuth2 credential management routes within `packages/server/src/routes/oauth2/index.ts`. The `authorize`, `callback`, and `refresh` endpoints perform database lookups for credentials using only the `id` (UUID) without verifying the `workspaceId`. Furthermore, the `callback` and `refresh` endpoints are explicitly whitelisted from authentication in `packages/server/src/utils/constants.ts`. An unauthenticated attacker with knowledge of a credential UUID can trigger a token refresh to obtain a valid `access_token` in the response body, or forge a callback to inject malicious tokens. Authenticated users can also leak metadata (client IDs and scopes) from credentials belonging to other workspaces. The issue is resolved in version 3.1.3 by enforcing workspace scoping and removing the authentication bypass.
Affected products
- FlowiseAI Flowise <= 3.1.2
Timeline
- 2026-07-29: disclosed
- 2026-08-04: advisory
- 2026-08-04: patched