Authorization bypass through user-controlled key in Flowise - CVE-2026-69250

 

Authorization bypass through user-controlled key in Flowise - CVE-2026-69250

Published: July 30, 2026


Vulnerability identifier: #VU140080
CSH Severity: Low
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-69250
CWE-ID: CWE-639
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote user to perform server-side request forgery and disclose sensitive information.

The vulnerability exists due to authorization bypass through user-controlled key in the OAuth2 token refresh endpoint in dist/routes/oauth2/index.js when handling refresh requests for a user-supplied credential ID and issuing a server-side POST request to a credential-controlled accessTokenUrl. A remote privileged user can send a crafted refresh request referencing a valid credential ID to perform server-side request forgery and disclose sensitive information.

The endpoint reflects the full remote response body to the caller through tokenInfo, and exploitation can expose OAuth2 client secrets and refresh tokens if an attacker-controlled OAuth2 credential has been configured.


Affected software

Flowise

How to mitigate CVE-2026-69250

Install security update from vendor's website.

Flowise - update to 3.1.3

External References

Related Security Bulletins