Authorization bypass through user-controlled key in Flowise - CVE-2026-69250
Published: July 30, 2026
Vulnerability details
The vulnerability allows a remote user to perform server-side request forgery and disclose sensitive information.
The vulnerability exists due to authorization bypass through user-controlled key in the OAuth2 token refresh endpoint in dist/routes/oauth2/index.js when handling refresh requests for a user-supplied credential ID and issuing a server-side POST request to a credential-controlled accessTokenUrl. A remote privileged user can send a crafted refresh request referencing a valid credential ID to perform server-side request forgery and disclose sensitive information.
The endpoint reflects the full remote response body to the caller through tokenInfo, and exploitation can expose OAuth2 client secrets and refresh tokens if an attacker-controlled OAuth2 credential has been configured.