CVE-2026-41273 - Flowise: Unauthenticated OAuth 2.0 Access Token Disclosure via Public Chatflow

Back Back to CVE browser

HIGH

Flowise: Unauthenticated OAuth 2.0 Access Token Disclosure via Public Chatflow

Published Apr 23, 2026

7.7

HIGH

CVSS 4.0

EPSS 0.44%

Description

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, Flowise contains an authentication bypass vulnerability that allows an unauthenticated attacker to obtain OAuth 2.0 access tokens associated with a public chatflow. By accessing a public chatflow configuration endpoint, an attacker can retrieve internal workflow data, including OAuth credential identifiers, which can then be used to refresh and obtain valid OAuth 2.0 access tokens without authentication. This vulnerability is fixed in 3.1.0.

Affected products

Vendor FlowiseAI Product Flowise Default
n/a
- Version
  < 3.1.0
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

FlowiseAI

Flowise

n/a

Version	Status	Constraints
< 3.1.0	affected	-

Ecosystem	Package	Introduced	Fixed
npm	flowise	0	3.1.0

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-306

Missing Authentication

References (4)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-25290
Advisory
https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-6f7g-v4pp-r667
exploitx_refsource_CONFIRMVendor Advisory
https://github.com/advisories/GHSA-6f7g-v4pp-r667
Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-41273

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-25290		Advisory
https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-6f7g-v4pp-r667		exploitx_refsource_CONFIRMVendor Advisory
https://github.com/advisories/GHSA-6f7g-v4pp-r667		Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-41273