# CVE-2026-70636: Flowise through 3.1.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to access…

Source: https://junglewise.ai/threats/cve-2026-70636-flowise-through-3-1-4-contains-an-authentication-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-06  
License: CC BY 4.0 with a link back

CVE-2026-70636 · Severity: high · CVSS 7.5 · Published 2026-08-06

Flowise through 3.1.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to access the OAuth2 credential refresh endpoint by exploiting prefix-based whitelist matching in the authentication middleware defined in packages/server/src/utils/constants.ts. Attackers can send a POST request to the oauth2-credential refresh route with a trailing credential identifier to bypass all authentication and authorization checks, triggering unauthorized OAuth token rotation against credentials belonging to any workspace and potentially disrupting dependent OAuth integrations. This is a bypass of CVE-2026-41273.

Technologies: [FlowiseAI Flowise](https://junglewise.ai/threats/technologies/flowiseai-flowise). Vendors: [FlowiseAI](https://junglewise.ai/threats/vendors/flowiseai).

## Quick answers

**Is CVE-2026-70636 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-70636 being exploited in the wild.

**How severe is CVE-2026-70636?** High severity, with a CVSS score of 7.5, published 6 August 2026.

**Which products and versions are affected?** FlowiseAI Flowise. The advisory does not name versions.

**Is there a fix for CVE-2026-70636?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected by CVE-2026-70636?** Check whether you run FlowiseAI Flowise. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- FlowiseAI Flowise

## Related threats

- [Flowise sandbox escape in custom function endpoint](https://junglewise.ai/threats/cve-2026-119978-flowise-through-3-1-4-contains-a-sandbox-escape-vulnerability)
- [Flowise credential lookup authorization bypass](https://junglewise.ai/threats/cve-2026-100609-flowise-npm-packages-flowise-and-flowise-components-through-3-1)
- [Flowise authentication bypass via email-only SSO matching](https://junglewise.ai/threats/cve-2026-100607-flowise-through-3-1-4-resolves-sso-and-local-password-users)
- [Flowise authentication bypass in SSO login path](https://junglewise.ai/threats/cve-2026-100606-flowise-through-3-1-4-enterprise-platform-mode-with-sso-enabled)
- [Flowise missing authorization checks on chat message routes](https://junglewise.ai/threats/cve-2026-100605-flowise-through-3-1-4-contains-missing-route-level-rbac-checks)