Vulnerability details

CVE-2026-70636

FlowiseAI Flowise

Flowise 3.1.4 Authentication Bypass via OAuth2 Credential Refresh Endpoint

CVSS 4.0

8.7High

Official description

Flowise through 3.1.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to access the OAuth2 credential refresh endpoint by exploiting prefix-based whitelist matching in the authentication middleware defined in packages/server/src/utils/constants.ts. Attackers can send a POST request to the oauth2-credential refresh route with a trailing credential identifier to bypass all authentication and authorization checks, triggering unauthorized OAuth token rotation against credentials belonging to any workspace and potentially disrupting dependent OAuth integrations. This is a bypass of CVE-2026-41273.

CVSS scores

Score	Version	Source	Vector
8.7High	4.0	CVEProject cvelistV5 (CNA) (VulnCheck)	`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N`
7.5High	3.1	CVEProject cvelistV5 (CNA) (VulnCheck)	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N`

Affected products

Vendor	Product	Versions	Source
FlowiseAI	Flowise	v ≤ 3.1.4	CVEProject cvelistV5 (CNA)

References and advisories

https://github.com/Caycon/cve-advisories/blob/main/2026/Flowise/CVE-2026-70636.md technical-descriptionexploit
https://flowiseai.com/sunset vendor-advisory
https://www.vulncheck.com/advisories/flowise-authentication-bypass-via-oauth2-credential-refresh-endpoint third-party-advisory

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-08-07
Last updated: 2026-08-14
State: Published
Assigner (CNA): VulnCheck

Exploit prediction (EPSS)

0.66%

Probability of exploitation in 30 days

51.8%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: Yes
Exploitation: Proof of concept
Technical impact: Partial

Weaknesses (CWE)

CWE-862
Missing Authorization