Flowise Unauthenticated OAuth2 Token Refresh Endpoint Enables Access Token Theft

Technical Analysis

The route POST /api/v1/oauth2-credential/refresh/:credentialId is listed in WHITELIST_URLS, bypassing Flowise's authentication middleware entirely. When called, the server decrypts the stored OAuth2 credential (clientId, clientSecret, refresh_token), performs a token refresh against the real OAuth provider, and echoes the resulting access_token back in the JSON response to the caller rather than only using it internally. An attacker only needs a valid credentialId — obtainable via credential enumeration or leakage from public chatflows — to trigger this flow and exfiltrate a working token for the victim's connected service, effectively crossing the trust boundary between the Flowise agent orchestration layer and downstream tool/service integrations. This is a broken object-level authorization and secrets-handling flaw at the tool-credential layer of an agentic automation platform, not a model-level or prompt-based attack.

Affected Systems

Flowise; protocols: OAuth2

Detection Signatures

• Unauthenticated POST requests to /api/v1/oauth2-credential/refresh/:credentialId
• Responses containing 'Credential not found' instead of 401 Unauthorized for unknown IDs
• Repeated/bulk refresh calls against varying credentialId values (enumeration pattern)
• Anomalous spike in OAuth provider refresh-token usage/quota consumption
• Access token appearing in HTTP response body of a server-side refresh call (should never be returned to client)

Remediation Steps

1. 1

   Remove endpoint from whitelist

   Remove POST /api/v1/oauth2-credential/refresh/:credentialId from WHITELIST_URLS in constants.ts and require standard authenticated session/API key checks on this route.

2. 2

   Stop returning access tokens to callers

   Modify the response to omit tokenInfo/access_token; only return a success status and non-sensitive metadata such as expires_at.

3. 3

   Enforce authorization on credential ownership

   Verify the authenticated user/workspace actually owns the credentialId before performing any refresh operation, preventing cross-tenant credential access.

4. 4

   Rotate exposed credentials

   Treat all OAuth2 credentials stored in affected Flowise instances as potentially compromised; rotate client secrets and revoke/reissue refresh tokens with connected providers.

5. 5

   Add rate limiting and monitoring

   Rate-limit the refresh endpoint and alert on repeated 'Credential not found' responses indicative of credentialId enumeration.

6. 6

   Upgrade Flowise

   Patch to a Flowise release beyond 3.1.2 that fixes this GHSA once available, and audit for similar whitelist misconfigurations on other credential-handling routes.