CyberRota Analysis
AI-GeneratedThe vulnerability affects Flowise versions prior to 3.1.3, specifically the unauthenticated POST /api/v1/oauth2-credential/refresh/:credentialId endpoint, which is improperly whitelisted. An attacker can exploit this flaw to obtain a refreshed access token using a valid credential ID, potentially gaining unauthorized access to connected services and exhausting refresh token quotas. Organizations using affected versions should prioritize upgrading to 3.1.3 to mitigate the risk of credential theft and service disruption.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the POST /api/v1/oauth2-credential/refresh/:credentialId endpoint is included in WHITELIST_URLS and requires no authentication. The endpoint decrypts the stored credential, sends a refresh request to the configured OAuth provider with the client secret and refresh token, and returns the refreshed access_token in the response body. An attacker with a credential ID can use the token to access the victim's connected service and can also exhaust refresh-token quota. This issue is fixed in 3.1.3.